frack113
020fc8061f
chore: Upgrade status level from `experimental` to `test` for rules that have not changed in 300 days --------- Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com> Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
41 lines
1.5 KiB
YAML
41 lines
1.5 KiB
YAML
title: Disable Important Scheduled Task
|
|
id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980
|
|
related:
|
|
- id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad # Security-Audting Eventlog
|
|
type: similar
|
|
status: test
|
|
description: Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities
|
|
references:
|
|
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-8---windows---disable-the-sr-scheduled-task
|
|
- https://twitter.com/MichalKoczwara/status/1553634816016498688
|
|
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
|
|
author: frack113, Nasreddine Bencherchali (Nextron Systems)
|
|
date: 2021/12/26
|
|
modified: 2022/09/02
|
|
tags:
|
|
- attack.impact
|
|
- attack.t1489
|
|
logsource:
|
|
category: process_creation
|
|
product: windows
|
|
detection:
|
|
schtasks_exe:
|
|
Image|endswith: '\schtasks.exe'
|
|
CommandLine|contains|all:
|
|
- '/Change'
|
|
- '/TN'
|
|
- '/disable'
|
|
CommandLine|contains:
|
|
# Add more important tasks
|
|
- '\Windows\SystemRestore\SR'
|
|
- '\Windows\Windows Defender\'
|
|
- '\Windows\BitLocker'
|
|
- '\Windows\WindowsBackup\'
|
|
- '\Windows\WindowsUpdate\'
|
|
- '\Windows\UpdateOrchestrator\'
|
|
- '\Windows\ExploitGuard'
|
|
condition: all of schtasks_*
|
|
falsepositives:
|
|
- Unknown
|
|
level: high
|