Skip to content

Commit 5e5d72a

Browse files
patel-bhavinpatel-bhavin
authored
Merge pull request #3316 from nterl0k/nterl0k-t1053-suspicious-task-lookups
Nterl0k - T1053 Windows Suspicious Sheduled Task + Lookup
2 parents 1132282 + 5060b8c commit 5e5d72a

6 files changed

+325
-0
lines changed

‎data_sources/windows_event_log_security_4700.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
name: Windows Event Log Security 4700
2+
id: 89895c7b-2aba-41ca-ad12-8b6d290b5dde
3+
version: 1
4+
date: '2025-03-11'
5+
author: Steven Dick
6+
description: Data source object for Windows Event Log Security 4700
7+
source: XmlWinEventLog:Security
8+
sourcetype: xmlwineventlog
9+
separator: EventID
10+
supported_TA:
11+
- name: Splunk Add-on for Microsoft Windows
12+
url: https://splunkbase.splunk.com/app/742
13+
version: 9.0.1
14+
fields:
15+
- EventID
16+
example_log: '<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4700</EventID> <Version>0</Version> <Level>0</Level> <Task>12804</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2015-09-23T02:32:47.606423000Z" /> <EventRecordID>344861</EventRecordID> <Correlation /> <Execution ProcessID="516" ThreadID="756" /> <Channel>Security</Channel> <Computer>DC01.contoso.local</Computer> <Security /> </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data> <Data Name="SubjectUserName">dadmin</Data> <Data Name="SubjectDomainName">CONTOSO</Data> <Data Name="SubjectLogonId">0x364eb</Data> <Data Name="TaskName">\\Microsoft\\StartListener</Data> <Data Name="TaskContent"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>LeastPrivilege</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data> </EventData> </Event>'

‎data_sources/windows_event_log_security_4702.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
name: Windows Event Log Security 4702
2+
id: 167e378e-3675-4042-b611-d3bfb6d2abc7
3+
version: 1
4+
date: '2025-03-11'
5+
author: Steven Dick
6+
description: Data source object for Windows Event Log Security 4702
7+
source: XmlWinEventLog:Security
8+
sourcetype: xmlwineventlog
9+
separator: EventID
10+
supported_TA:
11+
- name: Splunk Add-on for Microsoft Windows
12+
url: https://splunkbase.splunk.com/app/742
13+
version: 9.0.1
14+
fields:
15+
- EventID
16+
example_log: '<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4702</EventID> <Version>0</Version> <Level>0</Level> <Task>12804</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2015-09-23T03:00:59.343820000Z" /> <EventRecordID>344863</EventRecordID> <Correlation /> <Execution ProcessID="516" ThreadID="596" /> <Channel>Security</Channel> <Computer>DC01.contoso.local</Computer> <Security /> </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data> <Data Name="SubjectUserName">dadmin</Data> <Data Name="SubjectDomainName">CONTOSO</Data> <Data Name="SubjectLogonId">0x364eb</Data> <Data Name="TaskName">\\Microsoft\\StartListener</Data> <Data Name="TaskContentNew"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>HighestAvailable</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data> </EventData> </Event>'

‎detections/endpoint/windows_scheduled_task_with_suspicious_command.yml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
name: Windows Scheduled Task with Suspicious Command
2+
id: 1f44c126-c26a-4dd3-83bb-0f9a0f03ecc3
3+
version: 1
4+
date: '2025-02-07'
5+
author: Steven Dick
6+
status: production
7+
type: TTP
8+
description: The following analytic detects the creation of scheduled tasks designed to execute commands using native Windows shells like PowerShell, Cmd, Wscript, or Cscript or from public folders such as Users, Temp, or ProgramData. It leverages Windows Security EventCode 4698, 4700, and 4702 to identify when such tasks are registered, enabled, or modified. This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment.
9+
data_source:
10+
- Windows Event Log Security 4698
11+
- Windows Event Log Security 4700
12+
- Windows Event Log Security 4702
13+
search: |-
14+
`wineventlog_security` EventCode IN (4698,4700,4702)
15+
| eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent)
16+
| xmlkv TaskContent
17+
| stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Caller_User_Name, TaskName, Command, Enabled, Hidden, EventCode
18+
| lookup windows_suspicious_tasks task_command as Command
19+
| where tool == "shell command use" OR tool == "suspicious paths"
20+
| eval command=TaskName, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer, signature_id = EventCode
21+
| `security_content_ctime(firstTime)`
22+
| `security_content_ctime(lastTime)`
23+
| `windows_scheduled_task_with_suspicious_command_filter`
24+
how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required.
25+
known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately. Windows Defender, Google Chrome, and MS Edge updates may trigger this detection.
26+
references:
27+
- https://attack.mitre.org/techniques/T1053/005/
28+
- https://www.ic3.gov/CSA/2023/231213.pdf
29+
- https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/
30+
- https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_tasks_list.csv
31+
drilldown_searches:
32+
- name: View the detection results for - "$dest$" and "$user$"
33+
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
34+
earliest_offset: $info_min_time$
35+
latest_offset: $info_max_time$
36+
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
37+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
38+
earliest_offset: $info_min_time$
39+
latest_offset: $info_max_time$
40+
- name: Investigate schedule tasks on $dest$
41+
search: '`wineventlog_security` EventCode IN (4698,4700,4702) Computer="$dest$" Caller_User_Name="$user$"'
42+
earliest_offset: $info_min_time$
43+
latest_offset: $info_max_time$
44+
rba:
45+
message: A suspicious windows scheduled task named [$TaskName$] was detected on $dest$, this may be an indicator of [$tool$]
46+
risk_objects:
47+
- field: dest
48+
type: system
49+
score: 70
50+
- field: user
51+
type: user
52+
score: 70
53+
threat_objects:
54+
- field: Command
55+
type: signature
56+
tags:
57+
analytic_story:
58+
- Scheduled Tasks
59+
- Windows Persistence Techniques
60+
- Ransomware
61+
- Ryuk Ransomware
62+
asset_type: Endpoint
63+
mitre_attack_id:
64+
- T1053.005
65+
product:
66+
- Splunk Enterprise
67+
- Splunk Enterprise Security
68+
- Splunk Cloud
69+
security_domain: endpoint
70+
tests:
71+
- name: True Positive Test
72+
attack_data:
73+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log
74+
source: XmlWinEventLog:Security
75+
sourcetype: XmlWinEventLog

‎detections/endpoint/windows_scheduled_task_with_suspicious_name.yml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
name: Windows Scheduled Task with Suspicious Name
2+
id: 9e9ab4e3-c9d0-4967-a197-6d755e8a7e6e
3+
version: 1
4+
date: '2025-02-07'
5+
author: Steven Dick
6+
status: production
7+
type: TTP
8+
description: The following analytic detects the creation, modification, or enabling of scheduled tasks with known suspicious or malicious task names. It leverages Windows Security EventCode 4698, 4700, and 4702 to identify when such tasks are registered, modified, or enabled. This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment.
9+
data_source:
10+
- Windows Event Log Security 4698
11+
- Windows Event Log Security 4700
12+
- Windows Event Log Security 4702
13+
search: |-
14+
`wineventlog_security` EventCode IN (4698,4700,4702)
15+
| eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent)
16+
| xmlkv TaskContent
17+
| stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, TaskName, Command, Enabled, Hidden,Caller_User_Name, EventCode
18+
| lookup windows_suspicious_tasks task_name as TaskName
19+
| where isnotnull(tool_type)
20+
| eval command=TaskName, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer
21+
| `security_content_ctime(firstTime)`
22+
| `security_content_ctime(lastTime)`
23+
| `windows_scheduled_task_with_suspicious_name_filter`
24+
how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required.
25+
known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately.
26+
references:
27+
- https://attack.mitre.org/techniques/T1053/005/
28+
- https://www.ic3.gov/CSA/2023/231213.pdf
29+
- https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/
30+
- https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_tasks_list.csv
31+
drilldown_searches:
32+
- name: View the detection results for - "$dest$" and "$user$"
33+
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
34+
earliest_offset: $info_min_time$
35+
latest_offset: $info_max_time$
36+
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
37+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
38+
earliest_offset: $info_min_time$
39+
latest_offset: $info_max_time$
40+
- name: Investigate schedule tasks on $dest$
41+
search: '`wineventlog_security` EventCode IN (4698,4700,4702) | xmlkv TaskContent | search dest="$dest$" AND TaskName = "$TaskName$"'
42+
earliest_offset: $info_min_time$
43+
latest_offset: $info_max_time$
44+
rba:
45+
message: A windows scheduled task was created with known suspicious task name [$TaskName$] on $dest$, this may be a [$tool$] indicator
46+
risk_objects:
47+
- field: dest
48+
type: system
49+
score: 70
50+
- field: user
51+
type: user
52+
score: 70
53+
threat_objects:
54+
- field: Command
55+
type: signature
56+
tags:
57+
analytic_story:
58+
- Scheduled Tasks
59+
- Windows Persistence Techniques
60+
- Ransomware
61+
- Ryuk Ransomware
62+
asset_type: Endpoint
63+
mitre_attack_id:
64+
- T1053.005
65+
product:
66+
- Splunk Enterprise
67+
- Splunk Enterprise Security
68+
- Splunk Cloud
69+
security_domain: endpoint
70+
tests:
71+
- name: True Positive Test
72+
attack_data:
73+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_with_suspect_name/windows-xml.log
74+
source: XmlWinEventLog:Security
75+
sourcetype: XmlWinEventLog

0 commit comments

Comments
 (0)