From a1fe9672d74c40cb2da80f8189065ae737b0a622 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 27 Jun 2023 14:39:17 -0700 Subject: [PATCH 1/2] updates from doc team --- detections/endpoint/windows_powershell_scheduletask.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/windows_powershell_scheduletask.yml b/detections/endpoint/windows_powershell_scheduletask.yml index 1c1bfd81ed..d112d7877d 100644 --- a/detections/endpoint/windows_powershell_scheduletask.yml +++ b/detections/endpoint/windows_powershell_scheduletask.yml @@ -7,7 +7,12 @@ status: production type: Anomaly data_source: - Powershell 4104 -description: The following analytic detects potential malicious activities related to PowerShell's task scheduling cmdlets. It looks for anomalies in PowerShell logs, specifically EventCode 4104, associated with script block logging. The analytic flags unusual or suspicious use patterns of key task-related cmdlets such as 'New-ScheduledTask', 'Set-ScheduledTask', and others, which are often used by attackers for persistence and remote execution of malicious code. If a true positive is found, it suggests an possible attacker is attempting to persist within the environment or potentially deliver additional malicious payloads, leading to data theft, ransomware, or other damaging outcomes. To implement this analytic, PowerShell Script Block Logging needs to be enabled on some or all endpoints. Analysts should be aware of benign administrative tasks that can trigger alerts and tune the analytic accordingly to reduce false positives. Upon triage, review the PowerShell +description: "The Windows PowerShell ScheduleTask detects potential malicious activities connected with PowerShell's task scheduling cmdlets. This analytic identifies anomalies in PowerShell logs, specifically EventCode 4104, which is associated with script block logging.\ + +This analytic flags the unusual or suspicious use patterns of key task-related cmdlets, which are often used by attackers for persistence and the remote execution of malicious code such as 'New-ScheduledTask', 'Set-ScheduledTask', and so on. A true positive indicates that a possible attacker is trying to persist within the environment or potentially deliver additional malicious payloads that might lead to data theft, ransomware, or other harmful outcomes. \ + +To implement this analytic, PowerShell Script Block Logging needs to be enabled on some or all endpoints. Analysts must be aware of benign administrative tasks that can trigger alerts and customize the analytic to reduce false positives. Review the powershell after the triage." + search: '`powershell` EventCode=4104 ScriptBlockText IN ("*New-ScheduledTask*", "*New-ScheduledTaskAction*", "*New-ScheduledTaskSettingsSet*", "*New-ScheduledTaskTrigger*", "*Register-ClusteredScheduledTask*", "*Register-ScheduledTask*", "*Set-ClusteredScheduledTask*", "*Set-ScheduledTask*", "*Start-ScheduledTask*", "*Enable-ScheduledTask*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id | `security_content_ctime(firstTime)` From f9d403efa0e6c7a6f53d830c963adeaa1ab78be8 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 27 Jun 2023 15:06:00 -0700 Subject: [PATCH 2/2] Update windows_powershell_scheduletask.yml updated description --- detections/endpoint/windows_powershell_scheduletask.yml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_powershell_scheduletask.yml b/detections/endpoint/windows_powershell_scheduletask.yml index d112d7877d..2418a34a02 100644 --- a/detections/endpoint/windows_powershell_scheduletask.yml +++ b/detections/endpoint/windows_powershell_scheduletask.yml @@ -7,12 +7,11 @@ status: production type: Anomaly data_source: - Powershell 4104 -description: "The Windows PowerShell ScheduleTask detects potential malicious activities connected with PowerShell's task scheduling cmdlets. This analytic identifies anomalies in PowerShell logs, specifically EventCode 4104, which is associated with script block logging.\ +description: "The following analytic detects potential malicious activities related to PowerShell's task scheduling cmdlets. It looks for anomalies in PowerShell logs, specifically EventCode 4104, associated with script block logging. The analytic flags unusual or suspicious use patterns of key task-related cmdlets such as 'New-ScheduledTask', 'Set-ScheduledTask', and others, which are often used by attackers for persistence and remote execution of malicious code. \ -This analytic flags the unusual or suspicious use patterns of key task-related cmdlets, which are often used by attackers for persistence and the remote execution of malicious code such as 'New-ScheduledTask', 'Set-ScheduledTask', and so on. A true positive indicates that a possible attacker is trying to persist within the environment or potentially deliver additional malicious payloads that might lead to data theft, ransomware, or other harmful outcomes. \ - -To implement this analytic, PowerShell Script Block Logging needs to be enabled on some or all endpoints. Analysts must be aware of benign administrative tasks that can trigger alerts and customize the analytic to reduce false positives. Review the powershell after the triage." +If a true positive is found, it suggests an possible attacker is attempting to persist within the environment or potentially deliver additional malicious payloads, leading to data theft, ransomware, or other damaging outcomes. To implement this analytic, PowerShell Script Block Logging needs to be enabled on some or all endpoints. Analysts should be aware of benign administrative tasks that can trigger alerts and tune the analytic accordingly to reduce false positives. \ +Upon triage, review the PowerShell logs for any unusual or unexpected cmdlet usage, IP addresses, user accounts, or timestamps. If these factors align with known malicious behavior patterns, immediate mitigation steps, such as isolation of the affected systems, user account changes, and relevant threat hunting activities, should be initiated. This proactive analysis significantly enhances an organization's capacity to swiftly respond to, and potentially prevent, the execution of advanced persistent threats in their network." search: '`powershell` EventCode=4104 ScriptBlockText IN ("*New-ScheduledTask*", "*New-ScheduledTaskAction*", "*New-ScheduledTaskSettingsSet*", "*New-ScheduledTaskTrigger*", "*Register-ClusteredScheduledTask*", "*Register-ScheduledTask*", "*Set-ClusteredScheduledTask*", "*Set-ScheduledTask*", "*Start-ScheduledTask*", "*Enable-ScheduledTask*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id | `security_content_ctime(firstTime)`