name: Schtasks used for forcing a reboot
id: 1297fb80-f42a-4b4a-9c8a-88c066437cf6
version: 4
date: '2020-12-07'
author: Bhavin Patel, Splunk
type: batch
datamodel:
- Endpoint
description: This search looks for flags passed to schtasks.exe on the command-line
  that indicate that a forced reboot of system is scheduled.
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
  min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
  where Processes.process_name=schtasks.exe Processes.process="*shutdown*" Processes.process="*/create
  *" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user
  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `schtasks_used_for_forcing_a_reboot_filter`'
how_to_implement: To successfully implement this search you need to be ingesting logs
  with both the process name and command-line from your endpoints. If you are using
  Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: Administrators may create jobs on systems forcing reboots to
  perform updates, maintenance, etc.
references: []
tags:
  analytic_story:
  - Windows Persistence Techniques
  - Ransomware
  asset_type: Endpoint
  automated_detection_testing: passed
  cis20:
  - CIS 3
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtask_shutdown/windows-sysmon.log
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1053.005
  nist:
  - PR.IP
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.process
  - Processes.process_name
  - Processes.parent_process_name
  - Processes.dest
  - Processes.user
  security_domain: endpoint
