[metadata]
creation_date = "2020/11/17"
maturity = "production"
updated_date = "2020/11/17"

[rule]
author = ["Elastic"]
description = """
Identifies a suspicious image load (taskschd.dll) from Microsoft Office processes. This behavior may indicate
adversarial activity where a scheduled task is configured via Windows Component Object Model (COM). This technique can
be used to configure persistence and evade monitoring by avoiding the usage of the traditional Windows binary
(schtasks.exe) used to manage scheduled tasks.
"""
index = ["winlogbeat-*", "logs-endpoint.events.*"]
language = "eql"
license = "Elastic License"
name = "Suspicious Image Load (taskschd.dll) from MS Office"
references = [
    "https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16",
    "https://www.clearskysec.com/wp-content/uploads/2020/10/Operation-Quicksand.pdf",
]
risk_score = 21
rule_id = "baa5d22c-5e1c-4f33-bfc9-efa73bb53022"
severity = "low"
tags = ["Elastic", "Host", "Windows", "Threat Detection", "Execution"]
type = "eql"

query = '''
library where process.name in ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSPUB.EXE", "MSACCESS.EXE") and
  event.action == "load" and
  event.category == "library" and
  file.name == "taskschd.dll"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"


[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

