security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Tuning] Outbound Scheduled Task Activity via PowerShell (#5287)

Browse Source 
https://github.com/elastic/detection-rules/issues/5286

Verified cidrmatch on destination.ip works on both integrations (endpoint and sysmon):
This commit is contained in:
Samirbous
2025-11-17 10:02:50 +00:00
committed by GitHub
parent 4c984b0ed5
commit 64cc823481
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/execution_scheduled_task_powershell_source.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/12/15"
integration = ["endpoint", "windows"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2025/11/06"
[rule]
author = ["Elastic"]
@@ -76,7 +76,7 @@ query = '''
sequence by host.id, process.entity_id with maxspan = 5s
[any where host.os.type == "windows" and (event.category == "library" or (event.category == "process" and event.action : "Image loaded*")) and
(?dll.name : "taskschd.dll" or file.name : "taskschd.dll") and process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe")]
[network where host.os.type == "windows" and process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and destination.port == 135 and not destination.address in ("127.0.0.1", "::1")]
[network where host.os.type == "windows" and process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and destination.port == 135 and not cidrmatch(destination.ip, "127.0.0.0/8", "::1/128")]
'''