admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'develop' into headless_bee

Browse Source
This commit is contained in:
Bhavin Patel
2025-03-12 11:07:41 -07:00
committed by GitHub
parent 1d1d0dbd38 5e5d72a4bb
commit f8cd6cf14e
7 changed files with 383 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
data_sources/windows_event_log_security_4700.yml
+16
View File
@@ -0,0 +1,16 @@
name: Windows Event Log Security 4700
id: 89895c7b-2aba-41ca-ad12-8b6d290b5dde
version: 1
date: '2025-03-11'
author: Steven Dick
description: Data source object for Windows Event Log Security 4700
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
separator: EventID
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 9.0.1
fields:
- EventID
example_log: '<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4700</EventID> <Version>0</Version> <Level>0</Level> <Task>12804</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2015-09-23T02:32:47.606423000Z" /> <EventRecordID>344861</EventRecordID> <Correlation /> <Execution ProcessID="516" ThreadID="756" /> <Channel>Security</Channel> <Computer>DC01.contoso.local</Computer> <Security /> </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data> <Data Name="SubjectUserName">dadmin</Data> <Data Name="SubjectDomainName">CONTOSO</Data> <Data Name="SubjectLogonId">0x364eb</Data> <Data Name="TaskName">\\Microsoft\\StartListener</Data> <Data Name="TaskContent"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>LeastPrivilege</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data> </EventData> </Event>'
data_sources/windows_event_log_security_4702.yml
+16
View File
@@ -0,0 +1,16 @@
name: Windows Event Log Security 4702
id: 167e378e-3675-4042-b611-d3bfb6d2abc7
version: 1
date: '2025-03-11'
author: Steven Dick
description: Data source object for Windows Event Log Security 4702
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
separator: EventID
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 9.0.1
fields:
- EventID
example_log: '<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4702</EventID> <Version>0</Version> <Level>0</Level> <Task>12804</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2015-09-23T03:00:59.343820000Z" /> <EventRecordID>344863</EventRecordID> <Correlation /> <Execution ProcessID="516" ThreadID="596" /> <Channel>Security</Channel> <Computer>DC01.contoso.local</Computer> <Security /> </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data> <Data Name="SubjectUserName">dadmin</Data> <Data Name="SubjectDomainName">CONTOSO</Data> <Data Name="SubjectLogonId">0x364eb</Data> <Data Name="TaskName">\\Microsoft\\StartListener</Data> <Data Name="TaskContentNew"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>HighestAvailable</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data> </EventData> </Event>'
detections/cloud/o365_bec_email_hiding_rule_created.yml
+58
View File
@@ -0,0 +1,58 @@
name: O365 BEC Email Hiding Rule Created
id: 603ebac2-f157-4df7-a6ac-34e8d0350f86
version: 1
date: '2025-02-14'
author: '0xC0FFEEEE, Github Community'
type: TTP
status: production
description: This analytic detects mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers.
This may indicate that an attacker has gained access to the account.
search: '`o365_management_activity` Workload=Exchange Operation="New-InboxRule" |
stats values(Name) as Name, values(MarkAsRead) as MarkAsRead, values(MoveToFolder)
as MoveToFolder by _time Id user | lookup ut_shannon_lookup word as Name | eval
entropy_score=if(ut_shannon<=2, 1, 0) | eval len_score=if(len(Name)<=3, 1,0) | eval
read_score=if(MarkAsRead="True", 1, 0) | eval folder_score=if(match(MoveToFolder,
"^(RSS|Conversation History|Archive)"), 1, 0) | eval suspicious_score=entropy_score+len_score+read_score+folder_score
| where suspicious_score>2 | `o365_bec_email_hiding_rule_created_filter`'
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest
Office 365 management activity events. You also need to have the Splunk TA URL
Toolbox (https://splunkbase.splunk.com/app/2734/) installed.
known_false_positives: Short rule names may trigger false positives. Adjust
the entropy and length thresholds as needed.
references:
- https://attack.mitre.org/techniques/T1564/008/
drilldown_searches:
- name: View the detection results for - "$user$"
search: '%original_detection_search% | search dest = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for $user$
search: '| from datamodel Risk.All_Risk | search normalized_risk_object="$user$" starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Potential BEC mailbox rule was created by $user$
risk_objects:
- field: user
type: user
score: 25
threat_objects:
- field: Name
type: signature
tags:
analytic_story:
- Office 365 Account Takeover
asset_type: O365 Tenant
mitre_attack_id:
- T1564.008
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: audit
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1564.008/o365/o365_suspicious_mailbox_rule.log
sourcetype: o365:management:activity
source: o365
detections/endpoint/windows_scheduled_task_with_suspicious_command.yml
+75
View File
@@ -0,0 +1,75 @@
name: Windows Scheduled Task with Suspicious Command
id: 1f44c126-c26a-4dd3-83bb-0f9a0f03ecc3
version: 1
date: '2025-02-07'
author: Steven Dick
status: production
type: TTP
description: The following analytic detects the creation of scheduled tasks designed to execute commands using native Windows shells like PowerShell, Cmd, Wscript, or Cscript or from public folders such as Users, Temp, or ProgramData. It leverages Windows Security EventCode 4698, 4700, and 4702 to identify when such tasks are registered, enabled, or modified. This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment.
data_source:
- Windows Event Log Security 4698
- Windows Event Log Security 4700
- Windows Event Log Security 4702
search: |-
`wineventlog_security` EventCode IN (4698,4700,4702)
| eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent)
| xmlkv TaskContent
| stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Caller_User_Name, TaskName, Command, Enabled, Hidden, EventCode
| lookup windows_suspicious_tasks task_command as Command
| where tool == "shell command use" OR tool == "suspicious paths"
| eval command=TaskName, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer, signature_id = EventCode
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_scheduled_task_with_suspicious_command_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required.
known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately. Windows Defender, Google Chrome, and MS Edge updates may trigger this detection.
references:
- https://attack.mitre.org/techniques/T1053/005/
- https://www.ic3.gov/CSA/2023/231213.pdf
- https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/
- https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_tasks_list.csv
drilldown_searches:
- name: View the detection results for - "$dest$" and "$user$"
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: Investigate schedule tasks on $dest$
search: '`wineventlog_security` EventCode IN (4698,4700,4702) Computer="$dest$" Caller_User_Name="$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A suspicious windows scheduled task named [$TaskName$] was detected on $dest$, this may be an indicator of [$tool$]
risk_objects:
- field: dest
type: system
score: 70
- field: user
type: user
score: 70
threat_objects:
- field: Command
type: signature
tags:
analytic_story:
- Scheduled Tasks
- Windows Persistence Techniques
- Ransomware
- Ryuk Ransomware
asset_type: Endpoint
mitre_attack_id:
- T1053.005
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log
source: XmlWinEventLog:Security
sourcetype: XmlWinEventLog
detections/endpoint/windows_scheduled_task_with_suspicious_name.yml
+75
View File
@@ -0,0 +1,75 @@
name: Windows Scheduled Task with Suspicious Name
id: 9e9ab4e3-c9d0-4967-a197-6d755e8a7e6e
version: 1
date: '2025-02-07'
author: Steven Dick
status: production
type: TTP
description: The following analytic detects the creation, modification, or enabling of scheduled tasks with known suspicious or malicious task names. It leverages Windows Security EventCode 4698, 4700, and 4702 to identify when such tasks are registered, modified, or enabled. This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment.
data_source:
- Windows Event Log Security 4698
- Windows Event Log Security 4700
- Windows Event Log Security 4702
search: |-
`wineventlog_security` EventCode IN (4698,4700,4702)
| eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent)
| xmlkv TaskContent
| stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, TaskName, Command, Enabled, Hidden,Caller_User_Name, EventCode
| lookup windows_suspicious_tasks task_name as TaskName
| where isnotnull(tool_type)
| eval command=TaskName, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_scheduled_task_with_suspicious_name_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required.
known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately.
references:
- https://attack.mitre.org/techniques/T1053/005/
- https://www.ic3.gov/CSA/2023/231213.pdf
- https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/
- https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_tasks_list.csv
drilldown_searches:
- name: View the detection results for - "$dest$" and "$user$"
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: Investigate schedule tasks on $dest$
search: '`wineventlog_security` EventCode IN (4698,4700,4702) | xmlkv TaskContent | search dest="$dest$" AND TaskName = "$TaskName$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A windows scheduled task was created with known suspicious task name [$TaskName$] on $dest$, this may be a [$tool$] indicator
risk_objects:
- field: dest
type: system
score: 70
- field: user
type: user
score: 70
threat_objects:
- field: Command
type: signature
tags:
analytic_story:
- Scheduled Tasks
- Windows Persistence Techniques
- Ransomware
- Ryuk Ransomware
asset_type: Endpoint
mitre_attack_id:
- T1053.005
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_with_suspect_name/windows-xml.log
source: XmlWinEventLog:Security
sourcetype: XmlWinEventLog
lookups/windows_suspicious_tasks.csv
+128
View File
@@ -0,0 +1,128 @@
task_name,task_command,task_arguments,tool,tool_category,tool_type,link,severity,comment,reference
,*powershell.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A,
,*wscript.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A,
,*cscript.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A,
,*cmd.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A,
,*sh.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A,
,*ksh.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A,
,*zsh.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A,
,*bash.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A,
,*scrcons.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A,
,*pwsh.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A,
,powershell.exe,*-Command whoami*,whoami,Discovery,greyware_tool,https://github.com/mthcht/awesome-lists,medium,N/A,https://github.com/mthcht/awesome-lists
,powershell.exe,-encodedCommand *,powershell,Defense Evasion,greyware_tool,https://github.com/mthcht/awesome-lists,medium,base64 encoded command from a scheduled task,https://github.com/mthcht/awesome-lists
,powershell.exe,-enc *,powershell,Defense Evasion,greyware_tool,https://github.com/mthcht/awesome-lists,medium,base64 encoded command from a scheduled task,https://github.com/mthcht/awesome-lists
,cmd.exe,*/c whoami*,whoami,Discovery,greyware_tool,https://github.com/mthcht/awesome-lists,medium,N/A,https://github.com/mthcht/awesome-lists
\area41,C:\_Microsoft\Microsoft.exe,,CryptInject,Malware,offensive_tool,https://github.com/roadwy/DefenderYara/blob/9bbdb7f9fd3513ce30aa69cd1d88830e3cf596ca/Trojan/Win32/CryptInject/Trojan_Win32_CryptInject_PJ_MTB.yar#L36,critical,N/A,https://github.com/mthcht/awesome-lists
\OfficeServicesStatus,*wscript*\public\*,,ISMDoor,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-oilrig-uses-ismdoor-variant-possibly-linked-greenbug-threat-group/,high,N/A,https://github.com/mthcht/awesome-lists
\Business Aviation,*wscript*,,Gootloader,Malware,offensive_tool,https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/,critical,N/A,https://github.com/mthcht/awesome-lists
\Destination Branding,*wscript*,,Gootloader,Malware,offensive_tool,https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/,critical,N/A,https://github.com/mthcht/awesome-lists
\InetlSecurityAssistManager,*wscript *,,OopsIE,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/,high,N/A,https://github.com/mthcht/awesome-lists
,*wevtutil.exe,cl *,wevtutil,Defense Evasion,greyware_tool,https://github.com/mthcht/awesome-lists,high,clearing event logs with wevtutil.exe,https://github.com/mthcht/awesome-lists
\GoogleUpdateTaskMachineUI,*update.vbs*,,Helminth,Malware,offensive_tool,https://unit42.paloaltonetworks.com/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/,high,N/A,https://github.com/mthcht/awesome-lists
\Wow64 Subsystem,*programdata*mswow86.exe*,,NetSupport Manager,RAT,offensive_tool,https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/,medium,N/A,https://github.com/mthcht/awesome-lists
\copy,*powershell.exe*,*Copy-Item*\ProgramData\*,BlackJack,Ransomware,offensive_tool,https://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/securelist_com/blackjack-hacktivists-connection-with-twelve_113959/content.txt#L1515,high,N/A,https://github.com/mthcht/awesome-lists
\def,*powershell.exe*,*Get-MpPreference*,BlackJack,Ransomware,offensive_tool,https://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/securelist_com/blackjack-hacktivists-connection-with-twelve_113959/content.txt#L1515,high,N/A,https://github.com/mthcht/awesome-lists
\FJ_load,*madHcCtrl.exe*,,Danabot,Infostealer,offensive_tool,https://securelist.com/tusk-infostealers-campaign/113367/,high,N/A,https://github.com/mthcht/awesome-lists
\shell,*Invoke-PowerShellTcpRun*,,Schtasks_latmov.bat,Lateral Movement,offensive_tool,https://github.com/S3cur3Th1sSh1t/Creds/blob/f71e780c51fdc2fdabe4e51831fa6289b1bede96/batch/Schtasks_latmov.bat#L2,critical,N/A,https://github.com/mthcht/awesome-lists
*StageProxyOps*,*HTTP-Server.ps1*,,HTTP-Server,Persistence,offensive_tool,https://github.com/NullArray/WinBins-Plus/blob/1e4af04ceaa8085b532757a1331113e919a20f4b/Scripts/persist.cmd#L2,critical,N/A,https://github.com/mthcht/awesome-lists
\GoogleUpdatesTaskMachineUI,*fireeye.vbs*,,Helminth,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-oilrig-actors-provide-glimpse-development-testing-efforts/,high,N/A,https://github.com/mthcht/awesome-lists
\MicrosoftEdgeUpdateTaskMachineMS,*EdgeBrowser.cmd*,,MeshAgent,RAT,offensive_tool,https://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/securelist_com/awaken-likho-apt-new-implant-campaign_114101/content.txt#L831,high,N/A,https://github.com/mthcht/awesome-lists
\run1,*cmd.exe*,*/c *\ProgramData\*,BlackJack,Ransomware,offensive_tool,https://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/securelist_com/blackjack-hacktivists-connection-with-twelve_113959/content.txt#L1515,high,N/A,https://github.com/mthcht/awesome-lists
\SecurityAssist,*Certutil*,,OopsIE,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/,high,N/A,https://github.com/mthcht/awesome-lists
\mstask,*C:\temp\*,,Trojan.Win32.BreakWin,Malware,offensive_tool,https://www.sentinelone.com/labs/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll/,critical,N/A,https://github.com/mthcht/awesome-lists
\ReportHealth,*appdata*\srvHealth.exe*,,ISMInjector,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/,high,N/A,https://github.com/mthcht/awesome-lists
,*\Windows\Debug*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the *\Windows\Debug folder,https://github.com/mthcht/awesome-lists
\MicrosoftEdgeUpdateTaskMachineUC,*\users\public\*,,autohotkey,keylogger,offensive_tool,https://thedfirreport.com/2023/02/06/collect-exfiltrate-sleep-repeat/,high,N/A,https://github.com/mthcht/awesome-lists
,*\Users\public*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the Public user profile,https://github.com/mthcht/awesome-lists
,*\Users*\Downloads*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the users Downloads folder,https://github.com/mthcht/awesome-lists
,*\Users*\Documents*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the users Documents folder,https://github.com/mthcht/awesome-lists
,*\Users*\AppData\Roaming*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the roaming folder,https://github.com/mthcht/awesome-lists
,*\Users*\AppData\Local*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the appdata folder,https://github.com/mthcht/awesome-lists
\SystemFailureReporter,*\public\*,,SideTwist Backdoor (APT34),Malware,offensive_tool,https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/,critical,N/A,https://github.com/mthcht/awesome-lists
,*\ProgramData*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the ProgramData folder,https://github.com/mthcht/awesome-lists
\MEGA\MEGAsync Update Task*,*\MEGAupdater.exe,,MEGASync,Data Exfiltration,greyware_tool,https://mega.io/en/desktop,high,N/A,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/L-N/MEGAsync.csv
\WallPaperChangeApp,*\Autoit3\Autoit3.exe*,,OxtaRAT,Malware,offensive_tool,https://research.checkpoint.com/2023/operation-silent-watch-desktop-surveillance-in-azerbaijan-and-armenia/,critical,N/A,https://github.com/mthcht/awesome-lists
,*\AppData\Local\Temp\*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,high,task in the temp folder,https://github.com/mthcht/awesome-lists
\Microsoft_Auto_Scheduler,*\AppData\*,,Kube Ransomware,Ransomware,offensive_tool,https://x.com/ShanHolo/status/1880566701009563915/photo/1,high,N/A,https://github.com/mthcht/awesome-lists
,*:\Windows\Temp\*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,executable from the temp folder,https://github.com/mthcht/awesome-lists
,*:\windows\system32\calc.exe,,POC,exploitation,greyware_tool,https://x.com/hackingforbeer/status/1719402854085951883,medium,POC schtasks /create /sc minute /tn 'dongs' /tr 'C:\windows\system32\calc.exe',https://github.com/mthcht/awesome-lists
"\tMicNet Work40,",*.vbs*,,AsyncRAT,Malware,offensive_tool,https://any.run/cybersecurity-blog/asyncrat-open-directories-infection-analysis/,critical,AsyncRAT’s Infection samples,https://github.com/mthcht/awesome-lists
\yastcat,,,Wannamine,Cryptominer,offensive_tool,crowdstrike.com/blog/cryptomining-harmless-nuisance-disruptive-threat/,critical,Moonero miner - command SCHTASKS /create /RU System /SC DAILY /TN yastcat /f /TR %temp%\y1.bat &&SCHTASKS /run /TN yastcat,https://github.com/mthcht/awesome-lists
\OneNote 4726,,,Unkown,Malware,offensive_tool,https://x.com/Gi7w0rm/status/1864307803914981837,medium,N/A,https://github.com/mthcht/awesome-lists
\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeAll,,,Trojan.Win32.BreakWin,Malware,offensive_tool,https://www.sentinelone.com/labs/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll/,critical,N/A,https://github.com/mthcht/awesome-lists
\dongs,,,suspicious names,exploitation,offensive_tool,https://x.com/hackingforbeer/status/1719402854085951883,medium,POC schtasks /create /sc minute /tn 'dongs' /tr 'C:\windows\system32\calc.exe',https://github.com/mthcht/awesome-lists
\StopVMMSandKillVMWP,,,StopVMMSandKillVMWP script,Defense evasion,offensive_tool,https://x.com/GroupIB_DFIR/status/1750452267692728516,high,schtasks /create /tn StopVMMSandKillVMWP /tr 'powershell.exe -Command get-service -name vmms | stop-service -force ; taskkill /f /im vmwp.exe' /sc minute /mo 30 /ru SYSTEM /f,https://github.com/mthcht/awesome-lists
\SSH Key Exchange,,,sshd,Persistence,greyware_tool,https://www.trellix.com/blogs/research/cactus-ransomware-new-strain-in-the-market/,medium,compliance,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/schtasks.csv
\SSH Server,,,sshd,Persistence,greyware_tool,https://www.trellix.com/blogs/research/cactus-ransomware-new-strain-in-the-market/,medium,compliance,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/schtasks.csv
\MeterpeterC2,,,redpill,exploitation,offensive_tool,https://github.com/r00t-3xp10it/redpill/blob/611d39b8bff717ac84d58550dc04e1b312acb19e/bin/SchTasks.ps1#L83,critical,SchTasks.ps1,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/redpill.csv
\RedPillTask,,,redpill,exploitation,offensive_tool,https://github.com/r00t-3xp10it/redpill/blob/611d39b8bff717ac84d58550dc04e1b312acb19e/redpill.ps1#L743,critical,redpill.ps1,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/redpill.csv
\SQLC2AgentPS*,,,PowerUpSQL,C2,offensive_tool,https://github.com/NetSPI/PowerUpSQL/blob/a83cad211983290bf38708e6e237cacbfe023e32/scripts/pending/SQLC2.ps1#L958,critical,N/A,https://github.com/mthcht/awesome-lists
My Startup Task,,,Powershell-Scripts-for-Hackers-and-Pentesters,Persistence,offensive_tool,https://github.com/Whitecat18/Powershell-Scripts-for-Hackers-and-Pentesters/blob/788e89e9584b4b43f982721d59c06c77c0b3b566/PS-020.md?plain=1#L20,medium,N/A,https://github.com/mthcht/awesome-lists
,,*Set-MpPreference -DisableRealtimeMonitoring *,powershell,Defense Evasion,greyware_tool,https://github.com/mthcht/awesome-lists,high,disabling Defender Real time monitoring,https://github.com/mthcht/awesome-lists
\OneDrive Security,,,Nitrogen,Malware,offensive_tool,https://news.sophos.com/en-us/2023/07/26/into-the-tank-with-nitrogen/,high,N/A,https://github.com/mthcht/awesome-lists
\Demovale,,,Nightdoor,Malware,offensive_tool,lhttps://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/www_welivesecurity_com/en_eset-research_evasive-panda-leverages-monlam-festival-target-tibetans/content.txt#L269C143-L269C152,high,N/A,https://github.com/mthcht/awesome-lists
\8766714F94DD,,,more_eggs,Malware,offensive_tool,https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/n=,high,N/A,https://github.com/mthcht/awesome-lists
\Loki,,,LokiLocker,Ransomware,offensive_tool,https://blogs.blackberry.com/en/2022/03/lokilocker-ransomware,critical,command observed schtasks /CREATE /SC ONLOGON /TN Loki /TR *,https://github.com/mthcht/awesome-lists
\LimeRAT-Admin,,,Lime-RAT,Malware,offensive_tool,https://github.com/NYAN-x-CAT/Lime-RAT/blob/87e189781c0aef0e84cabe2f8c2e7d8f5143e594/Project/Client/C_Installation.vb#L76,critical,N/A,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/L-N/Lime-RAT.csv
\NFUBffk,,,LemonDuck,Malware,offensive_tool,https://notes.netbytesec.com/2024/10/lemonduck-unleashes-cryptomining.html,high,N/A,https://github.com/mthcht/awesome-lists
\K0adic,,,koadic,C2,offensive_tool,https://github.com/Averroes/koadic/blob/97886ed570f31efff09d1e06c4a7ece2d9b6bd27/data/implant/persist/schtasks.js#L4C21-L4C27,critical,N/A,https://github.com/mthcht/awesome-lists
\Feedback_API_VS_Services_Client,,,Keyzetsu clipper variant,Malware,offensive_tool,https://checkmarx.com/blog/new-technique-to-trick-developers-detected-in-an-open-source-supply-chain-attack/,medium,N/A,https://github.com/mthcht/awesome-lists
\Tater,,,Invoke-Tater,Privilege Escalation,offensive_tool,https://github.com/BC-SECURITY/Empire/blob/8aca42747da6cf2b0def7edede94586f6b3258e8/empire/server/data/module_source/privesc/Invoke-Tater.ps1#L101,critical,PowerShell implementation of the Hot Potato Windows Privilege Escalation exploit from @breenmachine and @foxglovesec,https://github.com/mthcht/awesome-lists
\\Defender,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\\defender,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\\Microsoft\\DefenderService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\\Microsoft\\Windows\\Application Experience\\StartupAppTaskCheck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\\Microsoft\\Windows\\Application Experience\\StartupAppTaskCkeck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\\Microsoft\\Windows\\ATPUpd,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\\Microsoft\\Windows\\Data Integrity Scan\Data Integrity Update,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\\Microsoft\\Windows\\DefenderUPDService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\\Microsoft\\Windows\\IISUpdateService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\\Microsoft\\Windows\\Speech\\SpeechModelInstallTask,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\\Microsoft\\Windows\\WiMSDFS,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\\Microsoft\\Windows\\Windows Defender\\Defender Update Service,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\\Microsoft\\Windows\\Windows Defender\\Service Update,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\\Microsoft\\Windows\\Windows Error Reporting\\CheckReporting,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\\Microsoft\\Windows\\Windows Error Reporting\\SubmitReporting,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\\Microsoft\\Windows\\Windows Filtering Platform\\BfeOnServiceStart,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\\Microsoft\\Windows\\WindowsDefenderService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\\Microsoft\\Windows\\WindowsDefenderService2,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\\Microsoft\\Windows\\WindowsUpdate\\Scheduled AutoCheck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Check,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\\WindowUpdate,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\Defender,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\defender,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\Microsoft\DefenderService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\Microsoft\Windows\Application Experience\StartupAppTaskCheck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\Microsoft\Windows\Application Experience\StartupAppTaskCkeck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\Microsoft\Windows\ATPUpd,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\Microsoft\Windows\Data Integrity Scan\Data Integrity Update,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\Microsoft\Windows\DefenderUPDService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\Microsoft\Windows\IISUpdateService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\Microsoft\Windows\Speech\SpeechModelInstallTask,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\Microsoft\Windows\WiMSDFS,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\Microsoft\Windows\Windows Defender\Defender Update Service,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\Microsoft\Windows\Windows Defender\Service Update,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\Microsoft\Windows\Windows Error Reporting\CheckReporting,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\Microsoft\Windows\Windows Error Reporting\SubmitReporting,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStart,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\Microsoft\Windows\WindowsDefenderService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\Microsoft\Windows\WindowsDefenderService2,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\Microsoft\Windows\WindowsUpdate\Scheduled AutoCheck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\Microsoft\Windows\WindowsUpdate\Scheduled Check,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\WindowUpdate,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists
\InfrSiRfucture Technologies,,,Gootloader,Malware,offensive_tool,https://thedfirreport.com/2024/02/26/seo-poisoning-to-domain-control-the-gootloader-saga-continues/,critical,N/A,https://github.com/mthcht/awesome-lists
\SynchronizeTimeZone,,,frp,Data Exfiltration,offensive_tool,https://www.aha.org/system/files/media/file/2021/05/fbi-flash-tlp-white-apt-actors-exploiting-fortinet-vulnerabilities-to-gain-access-for-malicious-activity-5-27-21.pdf,high,APT Actors Exploiting Fortinet Vulnerabilities to Gain Access for Malicious Activity - creating specific scheduled task for exfiltration,https://github.com/mthcht/awesome-lists
\CursorSvc,,,Fentanyl Stealer,Malware,offensive_tool,https://github.com/dekrypted/Fentanyl/blob/2b4a008934f21df4eed7b90fb3019d3395f7c909/fenty.py#L699C53-L699C62,critical,Similar to Bandit Stealer,https://github.com/mthcht/awesome-lists
\DisableBitdefender-*,,,Dispossesor,Ransomware,offensive_tool,https://vx-underground.org/Archive/Dispossessor%20Leaks,high,N/A,https://github.com/mthcht/awesome-lists
\DHARMA,,,Dharma,Ransomware,offensive_tool,https://www.joesandbox.com/analysis/860608/0/lighthtml,critical,command observed schtasks /CREATE /SC ONLOGON /TN DHARMA /TR C:\ProgramData\harma.exe*,https://github.com/mthcht/awesome-lists
\Sorry,,,Cryptominer,Cryptominer,offensive_tool,https://x.com/cglyer/status/1001463072672886785,high,schtasks /create /tn 'Sorry' /tr C:\Windows\Temp\taskhost.exe /sc daily /mo 2 /st 22:00:00 /f4,https://x.com/cglyer/status/1001463072672886785
\shadowdev,,,CobaltStrike,C2,offensive_tool,https://cloud.google.com/blog/topics/threat-intelligence/melting-unc2198-icedid-to-ransomware-operations,critical,cmd.exe /c schtasks /create /sc minute /mo 1 /tn shadowdev /tr C:\\ProgramData\\S\u0443sH\u0435\u0430ls\\T\u0430s\u0441host.exe,https://github.com/mthcht/awesome-lists
\ClearEventLogs,,,Cleareventlog script,Defense Evasion,offensive_tool,https://x.com/GroupIB_DFIR/status/1750452304606810175,high,schtasks /create /tn ClearEventLogs /tr 'powershell.exe -Command wevtutil el | foreach { wevtutil cl $_ }' /sc daily /st 03:00 /ru SYSTEM /f,https://github.com/mthcht/awesome-lists
\SC Scheduled Scan,,,Chafer,Malware,offensive_tool,https://nyotron.com/nyotron-discovers-next-generation-oilrig-attacks/,high,Chafer activity attributed to OilRig,https://github.com/mthcht/awesome-lists
\UpdatMachine,,,Chafer,Malware,offensive_tool,https://nyotron.com/nyotron-discovers-next-generation-oilrig-attacks/,high,Chafer activity attributed to OilRig,https://github.com/mthcht/awesome-lists
\drogon,,,BadRabbit,Malware,offensive_tool,https://www.vmray.com/analyses/bad-rabbit-ransomware-flash-analysis/report/overview.html,critical,schtasks /Create /SC once /TN drogon /RU SYSTEM /TR 'C:\Windows\system32\shutdown.exe /r /t 0 /f' /ST 02:34:00,https://github.com/mthcht/awesome-lists
\BaiduUpdateTask1,,,BADNEWS,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/,high,N/A,https://github.com/mthcht/awesome-lists
\AutoRDPwn,,,AutoRDPwn,C2,offensive_tool,https://github.com/JoelGMSec/AutoRDPwn/blob/839d6afbd2cfa64b01a188b4e09a3e079c9c81d3/AutoRDPwn.ps1#L678,critical,N/A,https://github.com/mthcht/awesome-lists
\thepiratMicrosoftEdgeUpdateTask,,,AsyncRAT,Malware,offensive_tool,https://any.run/cybersecurity-blog/asyncrat-open-directories-infection-analysis/,critical,AsyncRAT’s Infection samples,https://github.com/mthcht/awesome-lists
\kbnvmmmhjo,,,Agent Tesla,Malware,offensive_tool,https://isc.sans.edu/diary/PowerPoint+attachments+Agent+Tesla+and+code+reuse+in+malware/28154,critical,N/A,https://github.com/mthcht/awesome-lists
1 task_name task_command task_arguments tool tool_category tool_type link severity comment reference
2 *powershell.exe* shell command use exploitation greyware_tool https://attack.mitre.org/techniques/T1053/005/ medium N/A
3 *wscript.exe* shell command use exploitation greyware_tool https://attack.mitre.org/techniques/T1053/005/ medium N/A
4 *cscript.exe* shell command use exploitation greyware_tool https://attack.mitre.org/techniques/T1053/005/ medium N/A
5 *cmd.exe* shell command use exploitation greyware_tool https://attack.mitre.org/techniques/T1053/005/ medium N/A
6 *sh.exe* shell command use exploitation greyware_tool https://attack.mitre.org/techniques/T1053/005/ medium N/A
7 *ksh.exe* shell command use exploitation greyware_tool https://attack.mitre.org/techniques/T1053/005/ medium N/A
8 *zsh.exe* shell command use exploitation greyware_tool https://attack.mitre.org/techniques/T1053/005/ medium N/A
9 *bash.exe* shell command use exploitation greyware_tool https://attack.mitre.org/techniques/T1053/005/ medium N/A
10 *scrcons.exe* shell command use exploitation greyware_tool https://attack.mitre.org/techniques/T1053/005/ medium N/A
11 *pwsh.exe* shell command use exploitation greyware_tool https://attack.mitre.org/techniques/T1053/005/ medium N/A
12 powershell.exe *-Command whoami* whoami Discovery greyware_tool https://github.com/mthcht/awesome-lists medium N/A https://github.com/mthcht/awesome-lists
13 powershell.exe -encodedCommand * powershell Defense Evasion greyware_tool https://github.com/mthcht/awesome-lists medium base64 encoded command from a scheduled task https://github.com/mthcht/awesome-lists
14 powershell.exe -enc * powershell Defense Evasion greyware_tool https://github.com/mthcht/awesome-lists medium base64 encoded command from a scheduled task https://github.com/mthcht/awesome-lists
15 cmd.exe */c whoami* whoami Discovery greyware_tool https://github.com/mthcht/awesome-lists medium N/A https://github.com/mthcht/awesome-lists
16 \area41 C:\_Microsoft\Microsoft.exe CryptInject Malware offensive_tool https://github.com/roadwy/DefenderYara/blob/9bbdb7f9fd3513ce30aa69cd1d88830e3cf596ca/Trojan/Win32/CryptInject/Trojan_Win32_CryptInject_PJ_MTB.yar#L36 critical N/A https://github.com/mthcht/awesome-lists
17 \OfficeServicesStatus *wscript*\public\* ISMDoor Malware offensive_tool https://unit42.paloaltonetworks.com/unit42-oilrig-uses-ismdoor-variant-possibly-linked-greenbug-threat-group/ high N/A https://github.com/mthcht/awesome-lists
18 \Business Aviation *wscript* Gootloader Malware offensive_tool https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/ critical N/A https://github.com/mthcht/awesome-lists
19 \Destination Branding *wscript* Gootloader Malware offensive_tool https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/ critical N/A https://github.com/mthcht/awesome-lists
20 \InetlSecurityAssistManager *wscript * OopsIE Malware offensive_tool https://unit42.paloaltonetworks.com/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/ high N/A https://github.com/mthcht/awesome-lists
21 *wevtutil.exe cl * wevtutil Defense Evasion greyware_tool https://github.com/mthcht/awesome-lists high clearing event logs with wevtutil.exe https://github.com/mthcht/awesome-lists
22 \GoogleUpdateTaskMachineUI *update.vbs* Helminth Malware offensive_tool https://unit42.paloaltonetworks.com/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/ high N/A https://github.com/mthcht/awesome-lists
23 \Wow64 Subsystem *programdata*mswow86.exe* NetSupport Manager RAT offensive_tool https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/ medium N/A https://github.com/mthcht/awesome-lists
24 \copy *powershell.exe* *Copy-Item*\ProgramData\* BlackJack Ransomware offensive_tool https://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/securelist_com/blackjack-hacktivists-connection-with-twelve_113959/content.txt#L1515 high N/A https://github.com/mthcht/awesome-lists
25 \def *powershell.exe* *Get-MpPreference* BlackJack Ransomware offensive_tool https://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/securelist_com/blackjack-hacktivists-connection-with-twelve_113959/content.txt#L1515 high N/A https://github.com/mthcht/awesome-lists
26 \FJ_load *madHcCtrl.exe* Danabot Infostealer offensive_tool https://securelist.com/tusk-infostealers-campaign/113367/ high N/A https://github.com/mthcht/awesome-lists
27 \shell *Invoke-PowerShellTcpRun* Schtasks_latmov.bat Lateral Movement offensive_tool https://github.com/S3cur3Th1sSh1t/Creds/blob/f71e780c51fdc2fdabe4e51831fa6289b1bede96/batch/Schtasks_latmov.bat#L2 critical N/A https://github.com/mthcht/awesome-lists
28 *StageProxyOps* *HTTP-Server.ps1* HTTP-Server Persistence offensive_tool https://github.com/NullArray/WinBins-Plus/blob/1e4af04ceaa8085b532757a1331113e919a20f4b/Scripts/persist.cmd#L2 critical N/A https://github.com/mthcht/awesome-lists
29 \GoogleUpdatesTaskMachineUI *fireeye.vbs* Helminth Malware offensive_tool https://unit42.paloaltonetworks.com/unit42-oilrig-actors-provide-glimpse-development-testing-efforts/ high N/A https://github.com/mthcht/awesome-lists
30 \MicrosoftEdgeUpdateTaskMachineMS *EdgeBrowser.cmd* MeshAgent RAT offensive_tool https://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/securelist_com/awaken-likho-apt-new-implant-campaign_114101/content.txt#L831 high N/A https://github.com/mthcht/awesome-lists
31 \run1 *cmd.exe* */c *\ProgramData\* BlackJack Ransomware offensive_tool https://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/securelist_com/blackjack-hacktivists-connection-with-twelve_113959/content.txt#L1515 high N/A https://github.com/mthcht/awesome-lists
32 \SecurityAssist *Certutil* OopsIE Malware offensive_tool https://unit42.paloaltonetworks.com/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/ high N/A https://github.com/mthcht/awesome-lists
33 \mstask *C:\temp\* Trojan.Win32.BreakWin Malware offensive_tool https://www.sentinelone.com/labs/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll/ critical N/A https://github.com/mthcht/awesome-lists
34 \ReportHealth *appdata*\srvHealth.exe* ISMInjector Malware offensive_tool https://unit42.paloaltonetworks.com/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/ high N/A https://github.com/mthcht/awesome-lists
35 *\Windows\Debug* suspicious paths exploitation greyware_tool https://github.com/mthcht/awesome-lists medium task in the *\Windows\Debug folder https://github.com/mthcht/awesome-lists
36 \MicrosoftEdgeUpdateTaskMachineUC *\users\public\* autohotkey keylogger offensive_tool https://thedfirreport.com/2023/02/06/collect-exfiltrate-sleep-repeat/ high N/A https://github.com/mthcht/awesome-lists
37 *\Users\public* suspicious paths exploitation greyware_tool https://github.com/mthcht/awesome-lists medium task in the Public user profile https://github.com/mthcht/awesome-lists
38 *\Users*\Downloads* suspicious paths exploitation greyware_tool https://github.com/mthcht/awesome-lists medium task in the users Downloads folder https://github.com/mthcht/awesome-lists
39 *\Users*\Documents* suspicious paths exploitation greyware_tool https://github.com/mthcht/awesome-lists medium task in the users Documents folder https://github.com/mthcht/awesome-lists
40 *\Users*\AppData\Roaming* suspicious paths exploitation greyware_tool https://github.com/mthcht/awesome-lists medium task in the roaming folder https://github.com/mthcht/awesome-lists
41 *\Users*\AppData\Local* suspicious paths exploitation greyware_tool https://github.com/mthcht/awesome-lists medium task in the appdata folder https://github.com/mthcht/awesome-lists
42 \SystemFailureReporter *\public\* SideTwist Backdoor (APT34) Malware offensive_tool https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ critical N/A https://github.com/mthcht/awesome-lists
43 *\ProgramData* suspicious paths exploitation greyware_tool https://github.com/mthcht/awesome-lists medium task in the ProgramData folder https://github.com/mthcht/awesome-lists
44 \MEGA\MEGAsync Update Task* *\MEGAupdater.exe MEGASync Data Exfiltration greyware_tool https://mega.io/en/desktop high N/A https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/L-N/MEGAsync.csv
45 \WallPaperChangeApp *\Autoit3\Autoit3.exe* OxtaRAT Malware offensive_tool https://research.checkpoint.com/2023/operation-silent-watch-desktop-surveillance-in-azerbaijan-and-armenia/ critical N/A https://github.com/mthcht/awesome-lists
46 *\AppData\Local\Temp\* suspicious paths exploitation greyware_tool https://github.com/mthcht/awesome-lists high task in the temp folder https://github.com/mthcht/awesome-lists
47 \Microsoft_Auto_Scheduler *\AppData\* Kube Ransomware Ransomware offensive_tool https://x.com/ShanHolo/status/1880566701009563915/photo/1 high N/A https://github.com/mthcht/awesome-lists
48 *:\Windows\Temp\* suspicious paths exploitation greyware_tool https://github.com/mthcht/awesome-lists medium executable from the temp folder https://github.com/mthcht/awesome-lists
49 *:\windows\system32\calc.exe POC exploitation greyware_tool https://x.com/hackingforbeer/status/1719402854085951883 medium POC schtasks /create /sc minute /tn 'dongs' /tr 'C:\windows\system32\calc.exe' https://github.com/mthcht/awesome-lists
50 \tMicNet Work40, *.vbs* AsyncRAT Malware offensive_tool https://any.run/cybersecurity-blog/asyncrat-open-directories-infection-analysis/ critical AsyncRAT’s Infection samples https://github.com/mthcht/awesome-lists
51 \yastcat Wannamine Cryptominer offensive_tool crowdstrike.com/blog/cryptomining-harmless-nuisance-disruptive-threat/ critical Moonero miner - command SCHTASKS /create /RU System /SC DAILY /TN yastcat /f /TR %temp%\y1.bat &&SCHTASKS /run /TN yastcat https://github.com/mthcht/awesome-lists
52 \OneNote 4726 Unkown Malware offensive_tool https://x.com/Gi7w0rm/status/1864307803914981837 medium N/A https://github.com/mthcht/awesome-lists
53 \Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeAll Trojan.Win32.BreakWin Malware offensive_tool https://www.sentinelone.com/labs/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll/ critical N/A https://github.com/mthcht/awesome-lists
54 \dongs suspicious names exploitation offensive_tool https://x.com/hackingforbeer/status/1719402854085951883 medium POC schtasks /create /sc minute /tn 'dongs' /tr 'C:\windows\system32\calc.exe' https://github.com/mthcht/awesome-lists
55 \StopVMMSandKillVMWP StopVMMSandKillVMWP script Defense evasion offensive_tool https://x.com/GroupIB_DFIR/status/1750452267692728516 high schtasks /create /tn StopVMMSandKillVMWP /tr 'powershell.exe -Command get-service -name vmms | stop-service -force ; taskkill /f /im vmwp.exe' /sc minute /mo 30 /ru SYSTEM /f https://github.com/mthcht/awesome-lists
56 \SSH Key Exchange sshd Persistence greyware_tool https://www.trellix.com/blogs/research/cactus-ransomware-new-strain-in-the-market/ medium compliance https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/schtasks.csv
57 \SSH Server sshd Persistence greyware_tool https://www.trellix.com/blogs/research/cactus-ransomware-new-strain-in-the-market/ medium compliance https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/schtasks.csv
58 \MeterpeterC2 redpill exploitation offensive_tool https://github.com/r00t-3xp10it/redpill/blob/611d39b8bff717ac84d58550dc04e1b312acb19e/bin/SchTasks.ps1#L83 critical SchTasks.ps1 https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/redpill.csv
59 \RedPillTask redpill exploitation offensive_tool https://github.com/r00t-3xp10it/redpill/blob/611d39b8bff717ac84d58550dc04e1b312acb19e/redpill.ps1#L743 critical redpill.ps1 https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/redpill.csv
60 \SQLC2AgentPS* PowerUpSQL C2 offensive_tool https://github.com/NetSPI/PowerUpSQL/blob/a83cad211983290bf38708e6e237cacbfe023e32/scripts/pending/SQLC2.ps1#L958 critical N/A https://github.com/mthcht/awesome-lists
61 My Startup Task Powershell-Scripts-for-Hackers-and-Pentesters Persistence offensive_tool https://github.com/Whitecat18/Powershell-Scripts-for-Hackers-and-Pentesters/blob/788e89e9584b4b43f982721d59c06c77c0b3b566/PS-020.md?plain=1#L20 medium N/A https://github.com/mthcht/awesome-lists
62 *Set-MpPreference -DisableRealtimeMonitoring * powershell Defense Evasion greyware_tool https://github.com/mthcht/awesome-lists high disabling Defender Real time monitoring https://github.com/mthcht/awesome-lists
63 \OneDrive Security Nitrogen Malware offensive_tool https://news.sophos.com/en-us/2023/07/26/into-the-tank-with-nitrogen/ high N/A https://github.com/mthcht/awesome-lists
64 \Demovale Nightdoor Malware offensive_tool lhttps://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/www_welivesecurity_com/en_eset-research_evasive-panda-leverages-monlam-festival-target-tibetans/content.txt#L269C143-L269C152 high N/A https://github.com/mthcht/awesome-lists
65 \8766714F94DD more_eggs Malware offensive_tool https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/n= high N/A https://github.com/mthcht/awesome-lists
66 \Loki LokiLocker Ransomware offensive_tool https://blogs.blackberry.com/en/2022/03/lokilocker-ransomware critical command observed schtasks /CREATE /SC ONLOGON /TN Loki /TR * https://github.com/mthcht/awesome-lists
67 \LimeRAT-Admin Lime-RAT Malware offensive_tool https://github.com/NYAN-x-CAT/Lime-RAT/blob/87e189781c0aef0e84cabe2f8c2e7d8f5143e594/Project/Client/C_Installation.vb#L76 critical N/A https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/L-N/Lime-RAT.csv
68 \NFUBffk LemonDuck Malware offensive_tool https://notes.netbytesec.com/2024/10/lemonduck-unleashes-cryptomining.html high N/A https://github.com/mthcht/awesome-lists
69 \K0adic koadic C2 offensive_tool https://github.com/Averroes/koadic/blob/97886ed570f31efff09d1e06c4a7ece2d9b6bd27/data/implant/persist/schtasks.js#L4C21-L4C27 critical N/A https://github.com/mthcht/awesome-lists
70 \Feedback_API_VS_Services_Client Keyzetsu clipper variant Malware offensive_tool https://checkmarx.com/blog/new-technique-to-trick-developers-detected-in-an-open-source-supply-chain-attack/ medium N/A https://github.com/mthcht/awesome-lists
71 \Tater Invoke-Tater Privilege Escalation offensive_tool https://github.com/BC-SECURITY/Empire/blob/8aca42747da6cf2b0def7edede94586f6b3258e8/empire/server/data/module_source/privesc/Invoke-Tater.ps1#L101 critical PowerShell implementation of the Hot Potato Windows Privilege Escalation exploit from @breenmachine and @foxglovesec https://github.com/mthcht/awesome-lists
72 \\Defender GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
73 \\defender GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
74 \\Microsoft\\DefenderService GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
75 \\Microsoft\\Windows\\Application Experience\\StartupAppTaskCheck GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
76 \\Microsoft\\Windows\\Application Experience\\StartupAppTaskCkeck GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
77 \\Microsoft\\Windows\\ATPUpd GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
78 \\Microsoft\\Windows\\Data Integrity Scan\Data Integrity Update GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
79 \\Microsoft\\Windows\\DefenderUPDService GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
80 \\Microsoft\\Windows\\IISUpdateService GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
81 \\Microsoft\\Windows\\Speech\\SpeechModelInstallTask GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
82 \\Microsoft\\Windows\\WiMSDFS GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
83 \\Microsoft\\Windows\\Windows Defender\\Defender Update Service GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
84 \\Microsoft\\Windows\\Windows Defender\\Service Update GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
85 \\Microsoft\\Windows\\Windows Error Reporting\\CheckReporting GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
86 \\Microsoft\\Windows\\Windows Error Reporting\\SubmitReporting GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
87 \\Microsoft\\Windows\\Windows Filtering Platform\\BfeOnServiceStart GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
88 \\Microsoft\\Windows\\WindowsDefenderService GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
89 \\Microsoft\\Windows\\WindowsDefenderService2 GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
90 \\Microsoft\\Windows\\WindowsUpdate\\Scheduled AutoCheck GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
91 \\Microsoft\\Windows\\WindowsUpdate\\Scheduled Check GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
92 \\WindowUpdate GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
93 \Defender GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
94 \defender GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
95 \Microsoft\DefenderService GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
96 \Microsoft\Windows\Application Experience\StartupAppTaskCheck GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
97 \Microsoft\Windows\Application Experience\StartupAppTaskCkeck GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
98 \Microsoft\Windows\ATPUpd GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
99 \Microsoft\Windows\Data Integrity Scan\Data Integrity Update GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
100 \Microsoft\Windows\DefenderUPDService GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
101 \Microsoft\Windows\IISUpdateService GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
102 \Microsoft\Windows\Speech\SpeechModelInstallTask GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
103 \Microsoft\Windows\WiMSDFS GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
104 \Microsoft\Windows\Windows Defender\Defender Update Service GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
105 \Microsoft\Windows\Windows Defender\Service Update GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
106 \Microsoft\Windows\Windows Error Reporting\CheckReporting GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
107 \Microsoft\Windows\Windows Error Reporting\SubmitReporting GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
108 \Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStart GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
109 \Microsoft\Windows\WindowsDefenderService GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
110 \Microsoft\Windows\WindowsDefenderService2 GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
111 \Microsoft\Windows\WindowsUpdate\Scheduled AutoCheck GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
112 \Microsoft\Windows\WindowsUpdate\Scheduled Check GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
113 \WindowUpdate GraphicalProton backdoor Malware offensive_tool https://www.ic3.gov/CSA/2023/231213.pdf high N/A https://github.com/mthcht/awesome-lists
114 \InfrSiRfucture Technologies Gootloader Malware offensive_tool https://thedfirreport.com/2024/02/26/seo-poisoning-to-domain-control-the-gootloader-saga-continues/ critical N/A https://github.com/mthcht/awesome-lists
115 \SynchronizeTimeZone frp Data Exfiltration offensive_tool https://www.aha.org/system/files/media/file/2021/05/fbi-flash-tlp-white-apt-actors-exploiting-fortinet-vulnerabilities-to-gain-access-for-malicious-activity-5-27-21.pdf high APT Actors Exploiting Fortinet Vulnerabilities to Gain Access for Malicious Activity - creating specific scheduled task for exfiltration https://github.com/mthcht/awesome-lists
116 \CursorSvc Fentanyl Stealer Malware offensive_tool https://github.com/dekrypted/Fentanyl/blob/2b4a008934f21df4eed7b90fb3019d3395f7c909/fenty.py#L699C53-L699C62 critical Similar to Bandit Stealer https://github.com/mthcht/awesome-lists
117 \DisableBitdefender-* Dispossesor Ransomware offensive_tool https://vx-underground.org/Archive/Dispossessor%20Leaks high N/A https://github.com/mthcht/awesome-lists
118 \DHARMA Dharma Ransomware offensive_tool https://www.joesandbox.com/analysis/860608/0/lighthtml critical command observed schtasks /CREATE /SC ONLOGON /TN DHARMA /TR C:\ProgramData\harma.exe* https://github.com/mthcht/awesome-lists
119 \Sorry Cryptominer Cryptominer offensive_tool https://x.com/cglyer/status/1001463072672886785 high schtasks /create /tn 'Sorry' /tr C:\Windows\Temp\taskhost.exe /sc daily /mo 2 /st 22:00:00 /f4 https://x.com/cglyer/status/1001463072672886785
120 \shadowdev CobaltStrike C2 offensive_tool https://cloud.google.com/blog/topics/threat-intelligence/melting-unc2198-icedid-to-ransomware-operations critical cmd.exe /c schtasks /create /sc minute /mo 1 /tn shadowdev /tr C:\\ProgramData\\S\u0443sH\u0435\u0430ls\\T\u0430s\u0441host.exe https://github.com/mthcht/awesome-lists
121 \ClearEventLogs Cleareventlog script Defense Evasion offensive_tool https://x.com/GroupIB_DFIR/status/1750452304606810175 high schtasks /create /tn ClearEventLogs /tr 'powershell.exe -Command wevtutil el | foreach { wevtutil cl $_ }' /sc daily /st 03:00 /ru SYSTEM /f https://github.com/mthcht/awesome-lists
122 \SC Scheduled Scan Chafer Malware offensive_tool https://nyotron.com/nyotron-discovers-next-generation-oilrig-attacks/ high Chafer activity attributed to OilRig https://github.com/mthcht/awesome-lists
123 \UpdatMachine Chafer Malware offensive_tool https://nyotron.com/nyotron-discovers-next-generation-oilrig-attacks/ high Chafer activity attributed to OilRig https://github.com/mthcht/awesome-lists
124 \drogon BadRabbit Malware offensive_tool https://www.vmray.com/analyses/bad-rabbit-ransomware-flash-analysis/report/overview.html critical schtasks /Create /SC once /TN drogon /RU SYSTEM /TR 'C:\Windows\system32\shutdown.exe /r /t 0 /f' /ST 02:34:00 https://github.com/mthcht/awesome-lists
125 \BaiduUpdateTask1 BADNEWS Malware offensive_tool https://unit42.paloaltonetworks.com/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/ high N/A https://github.com/mthcht/awesome-lists
126 \AutoRDPwn AutoRDPwn C2 offensive_tool https://github.com/JoelGMSec/AutoRDPwn/blob/839d6afbd2cfa64b01a188b4e09a3e079c9c81d3/AutoRDPwn.ps1#L678 critical N/A https://github.com/mthcht/awesome-lists
127 \thepiratMicrosoftEdgeUpdateTask AsyncRAT Malware offensive_tool https://any.run/cybersecurity-blog/asyncrat-open-directories-infection-analysis/ critical AsyncRAT’s Infection samples https://github.com/mthcht/awesome-lists
128 \kbnvmmmhjo Agent Tesla Malware offensive_tool https://isc.sans.edu/diary/PowerPoint+attachments+Agent+Tesla+and+code+reuse+in+malware/28154 critical N/A https://github.com/mthcht/awesome-lists
lookups/windows_suspicious_tasks.yml
+15
View File
@@ -0,0 +1,15 @@
name: windows_suspicious_tasks
date: 2025-02-07
version: 1
id: 928cba69-be80-4601-9b0d-3ec81f714338
author: Steven Dick
lookup_type: csv
description: A list of suspicious Windows Scheduled Task names and locations
default_match: false
match_type:
- WILDCARD(task_name)
- WILDCARD(task_command)
- WILDCARD(task_arguments)
min_matches: 1
max_matches: 1
case_sensitive_match: false