Merge pull request #2038 from splunk/tasktask

Tasktask

.github/pull_request_template.md

@@ -1,12 +1,12 @@
 # PR Template for new Detections
 
 For Authors:
-1. Make sure that CI/CD [detection-testing and build-and-validate](https://github.com/splunk/security_content/actions) jobs passed ✔️. 
+- [ ] Make sure that CI/CD [detection-testing and build-and-validate](https://github.com/splunk/security_content/actions) jobs passed ✔️. 
 
 For Reviewers:
 - [ ] Verify CI/CD jobs have passed without errors.
 - [ ] Validate SPL logic.
 - [ ] Validate tags, description, and how to implement.
-- [ ] Validate name patches `<platform>_<mitre att&ck technique>_<short description>`
+- [ ] Validate name matches `<platform>_<mitre att&ck technique>_<short description>`
 - [ ] Verify references match analytic.
 - [ ] Is there an Atomic Test?

detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml

@@ -1,31 +1,29 @@
 name: Scheduled Task Deleted Or Created via CMD
 id: d5af132c-7c17-439c-9d31-13d55340f36c
-version: 5
-date: '2020-12-17'
+version: 6
+date: '2022-02-22'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search looks for flags passed to schtasks.exe on the command-line
-  that indicate a task was created via command like. This has been associated with
+description: The following analytic identifies the creation or deletion of a scheduled task using schtasks.exe with flags - create or delete being passed on the command-line. This has been associated with
   the Dragonfly threat actor, and the SUNBURST attack against Solarwinds.
+  This analytic replaces "Scheduled Task used in BadRabbit Ransomware".
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe
   (Processes.process=*delete* OR Processes.process=*create*) by Processes.user Processes.process_name
   Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_deleted_or_created_via_cmd_filter` '
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints to populate the Endpoint
-  data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model.
-known_false_positives: Tasks should not be manually created via CLI, this is rarely
-  done by admins as well
-references: []
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: It is possible scripts or administrators may trigger this analytic. Filter as needed based on parent process, application.
+references:
+  - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
 tags:
   analytic_story:
   - DHS Report TA18-074A
   - NOBELIUM Group
+  - Windows Persistence Techniques
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20: