diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml new file mode 100644 index 0000000000..56b76ecfdf --- /dev/null +++ b/data_sources/windows_event_log_security_4700.yml @@ -0,0 +1,16 @@ +name: Windows Event Log Security 4700 +id: 89895c7b-2aba-41ca-ad12-8b6d290b5dde +version: 1 +date: '2025-03-11' +author: Steven Dick +description: Data source object for Windows Event Log Security 4700 +source: XmlWinEventLog:Security +sourcetype: xmlwineventlog +separator: EventID +supported_TA: +- name: Splunk Add-on for Microsoft Windows + url: https://splunkbase.splunk.com/app/742 + version: 9.0.1 +fields: +- EventID +example_log: ' 4700 0 0 12804 0 0x8020000000000000 344861 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin LeastPrivilege CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe ' diff --git a/data_sources/windows_event_log_security_4702.yml b/data_sources/windows_event_log_security_4702.yml new file mode 100644 index 0000000000..b6056ee988 --- /dev/null +++ b/data_sources/windows_event_log_security_4702.yml @@ -0,0 +1,16 @@ +name: Windows Event Log Security 4702 +id: 167e378e-3675-4042-b611-d3bfb6d2abc7 +version: 1 +date: '2025-03-11' +author: Steven Dick +description: Data source object for Windows Event Log Security 4702 +source: XmlWinEventLog:Security +sourcetype: xmlwineventlog +separator: EventID +supported_TA: +- name: Splunk Add-on for Microsoft Windows + url: https://splunkbase.splunk.com/app/742 + version: 9.0.1 +fields: +- EventID +example_log: ' 4702 0 0 12804 0 0x8020000000000000 344863 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin HighestAvailable CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe ' diff --git a/detections/cloud/o365_bec_email_hiding_rule_created.yml b/detections/cloud/o365_bec_email_hiding_rule_created.yml new file mode 100644 index 0000000000..51e7cd1c9a --- /dev/null +++ b/detections/cloud/o365_bec_email_hiding_rule_created.yml @@ -0,0 +1,58 @@ +name: O365 BEC Email Hiding Rule Created +id: 603ebac2-f157-4df7-a6ac-34e8d0350f86 +version: 1 +date: '2025-02-14' +author: '0xC0FFEEEE, Github Community' +type: TTP +status: production +description: This analytic detects mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers. + This may indicate that an attacker has gained access to the account. +search: '`o365_management_activity` Workload=Exchange Operation="New-InboxRule" | + stats values(Name) as Name, values(MarkAsRead) as MarkAsRead, values(MoveToFolder) + as MoveToFolder by _time Id user | lookup ut_shannon_lookup word as Name | eval + entropy_score=if(ut_shannon<=2, 1, 0) | eval len_score=if(len(Name)<=3, 1,0) | eval + read_score=if(MarkAsRead="True", 1, 0) | eval folder_score=if(match(MoveToFolder, + "^(RSS|Conversation History|Archive)"), 1, 0) | eval suspicious_score=entropy_score+len_score+read_score+folder_score + | where suspicious_score>2 | `o365_bec_email_hiding_rule_created_filter`' +how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest + Office 365 management activity events. You also need to have the Splunk TA URL + Toolbox (https://splunkbase.splunk.com/app/2734/) installed. +known_false_positives: Short rule names may trigger false positives. Adjust + the entropy and length thresholds as needed. +references: +- https://attack.mitre.org/techniques/T1564/008/ +drilldown_searches: +- name: View the detection results for - "$user$" + search: '%original_detection_search% | search dest = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for $user$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object="$user$" starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Potential BEC mailbox rule was created by $user$ + risk_objects: + - field: user + type: user + score: 25 + threat_objects: + - field: Name + type: signature +tags: + analytic_story: + - Office 365 Account Takeover + asset_type: O365 Tenant + mitre_attack_id: + - T1564.008 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: audit +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1564.008/o365/o365_suspicious_mailbox_rule.log + sourcetype: o365:management:activity + source: o365 diff --git a/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml b/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml new file mode 100644 index 0000000000..a935ff3610 --- /dev/null +++ b/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml @@ -0,0 +1,75 @@ +name: Windows Scheduled Task with Suspicious Command +id: 1f44c126-c26a-4dd3-83bb-0f9a0f03ecc3 +version: 1 +date: '2025-02-07' +author: Steven Dick +status: production +type: TTP +description: The following analytic detects the creation of scheduled tasks designed to execute commands using native Windows shells like PowerShell, Cmd, Wscript, or Cscript or from public folders such as Users, Temp, or ProgramData. It leverages Windows Security EventCode 4698, 4700, and 4702 to identify when such tasks are registered, enabled, or modified. This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment. +data_source: +- Windows Event Log Security 4698 +- Windows Event Log Security 4700 +- Windows Event Log Security 4702 +search: |- + `wineventlog_security` EventCode IN (4698,4700,4702) + | eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent) + | xmlkv TaskContent + | stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Caller_User_Name, TaskName, Command, Enabled, Hidden, EventCode + | lookup windows_suspicious_tasks task_command as Command + | where tool == "shell command use" OR tool == "suspicious paths" + | eval command=TaskName, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer, signature_id = EventCode + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_scheduled_task_with_suspicious_command_filter` +how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. +known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately. Windows Defender, Google Chrome, and MS Edge updates may trigger this detection. +references: +- https://attack.mitre.org/techniques/T1053/005/ +- https://www.ic3.gov/CSA/2023/231213.pdf +- https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/ +- https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_tasks_list.csv +drilldown_searches: +- name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: Investigate schedule tasks on $dest$ + search: '`wineventlog_security` EventCode IN (4698,4700,4702) Computer="$dest$" Caller_User_Name="$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A suspicious windows scheduled task named [$TaskName$] was detected on $dest$, this may be an indicator of [$tool$] + risk_objects: + - field: dest + type: system + score: 70 + - field: user + type: user + score: 70 + threat_objects: + - field: Command + type: signature +tags: + analytic_story: + - Scheduled Tasks + - Windows Persistence Techniques + - Ransomware + - Ryuk Ransomware + asset_type: Endpoint + mitre_attack_id: + - T1053.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml b/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml new file mode 100644 index 0000000000..9c039ab87b --- /dev/null +++ b/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml @@ -0,0 +1,75 @@ +name: Windows Scheduled Task with Suspicious Name +id: 9e9ab4e3-c9d0-4967-a197-6d755e8a7e6e +version: 1 +date: '2025-02-07' +author: Steven Dick +status: production +type: TTP +description: The following analytic detects the creation, modification, or enabling of scheduled tasks with known suspicious or malicious task names. It leverages Windows Security EventCode 4698, 4700, and 4702 to identify when such tasks are registered, modified, or enabled. This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment. +data_source: +- Windows Event Log Security 4698 +- Windows Event Log Security 4700 +- Windows Event Log Security 4702 +search: |- + `wineventlog_security` EventCode IN (4698,4700,4702) + | eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent) + | xmlkv TaskContent + | stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, TaskName, Command, Enabled, Hidden,Caller_User_Name, EventCode + | lookup windows_suspicious_tasks task_name as TaskName + | where isnotnull(tool_type) + | eval command=TaskName, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_scheduled_task_with_suspicious_name_filter` +how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. +known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately. +references: +- https://attack.mitre.org/techniques/T1053/005/ +- https://www.ic3.gov/CSA/2023/231213.pdf +- https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/ +- https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_tasks_list.csv +drilldown_searches: +- name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: Investigate schedule tasks on $dest$ + search: '`wineventlog_security` EventCode IN (4698,4700,4702) | xmlkv TaskContent | search dest="$dest$" AND TaskName = "$TaskName$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A windows scheduled task was created with known suspicious task name [$TaskName$] on $dest$, this may be a [$tool$] indicator + risk_objects: + - field: dest + type: system + score: 70 + - field: user + type: user + score: 70 + threat_objects: + - field: Command + type: signature +tags: + analytic_story: + - Scheduled Tasks + - Windows Persistence Techniques + - Ransomware + - Ryuk Ransomware + asset_type: Endpoint + mitre_attack_id: + - T1053.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_with_suspect_name/windows-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/lookups/windows_suspicious_tasks.csv b/lookups/windows_suspicious_tasks.csv new file mode 100644 index 0000000000..fdb712acae --- /dev/null +++ b/lookups/windows_suspicious_tasks.csv @@ -0,0 +1,128 @@ +task_name,task_command,task_arguments,tool,tool_category,tool_type,link,severity,comment,reference +,*powershell.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*wscript.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*cscript.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*cmd.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*sh.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*ksh.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*zsh.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*bash.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*scrcons.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*pwsh.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,powershell.exe,*-Command whoami*,whoami,Discovery,greyware_tool,https://github.com/mthcht/awesome-lists,medium,N/A,https://github.com/mthcht/awesome-lists +,powershell.exe,-encodedCommand *,powershell,Defense Evasion,greyware_tool,https://github.com/mthcht/awesome-lists,medium,base64 encoded command from a scheduled task,https://github.com/mthcht/awesome-lists +,powershell.exe,-enc *,powershell,Defense Evasion,greyware_tool,https://github.com/mthcht/awesome-lists,medium,base64 encoded command from a scheduled task,https://github.com/mthcht/awesome-lists +,cmd.exe,*/c whoami*,whoami,Discovery,greyware_tool,https://github.com/mthcht/awesome-lists,medium,N/A,https://github.com/mthcht/awesome-lists +\area41,C:\_Microsoft\Microsoft.exe,,CryptInject,Malware,offensive_tool,https://github.com/roadwy/DefenderYara/blob/9bbdb7f9fd3513ce30aa69cd1d88830e3cf596ca/Trojan/Win32/CryptInject/Trojan_Win32_CryptInject_PJ_MTB.yar#L36,critical,N/A,https://github.com/mthcht/awesome-lists +\OfficeServicesStatus,*wscript*\public\*,,ISMDoor,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-oilrig-uses-ismdoor-variant-possibly-linked-greenbug-threat-group/,high,N/A,https://github.com/mthcht/awesome-lists +\Business Aviation,*wscript*,,Gootloader,Malware,offensive_tool,https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/,critical,N/A,https://github.com/mthcht/awesome-lists +\Destination Branding,*wscript*,,Gootloader,Malware,offensive_tool,https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/,critical,N/A,https://github.com/mthcht/awesome-lists +\InetlSecurityAssistManager,*wscript *,,OopsIE,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/,high,N/A,https://github.com/mthcht/awesome-lists +,*wevtutil.exe,cl *,wevtutil,Defense Evasion,greyware_tool,https://github.com/mthcht/awesome-lists,high,clearing event logs with wevtutil.exe,https://github.com/mthcht/awesome-lists +\GoogleUpdateTaskMachineUI,*update.vbs*,,Helminth,Malware,offensive_tool,https://unit42.paloaltonetworks.com/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/,high,N/A,https://github.com/mthcht/awesome-lists +\Wow64 Subsystem,*programdata*mswow86.exe*,,NetSupport Manager,RAT,offensive_tool,https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/,medium,N/A,https://github.com/mthcht/awesome-lists +\copy,*powershell.exe*,*Copy-Item*\ProgramData\*,BlackJack,Ransomware,offensive_tool,https://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/securelist_com/blackjack-hacktivists-connection-with-twelve_113959/content.txt#L1515,high,N/A,https://github.com/mthcht/awesome-lists +\def,*powershell.exe*,*Get-MpPreference*,BlackJack,Ransomware,offensive_tool,https://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/securelist_com/blackjack-hacktivists-connection-with-twelve_113959/content.txt#L1515,high,N/A,https://github.com/mthcht/awesome-lists +\FJ_load,*madHcCtrl.exe*,,Danabot,Infostealer,offensive_tool,https://securelist.com/tusk-infostealers-campaign/113367/,high,N/A,https://github.com/mthcht/awesome-lists +\shell,*Invoke-PowerShellTcpRun*,,Schtasks_latmov.bat,Lateral Movement,offensive_tool,https://github.com/S3cur3Th1sSh1t/Creds/blob/f71e780c51fdc2fdabe4e51831fa6289b1bede96/batch/Schtasks_latmov.bat#L2,critical,N/A,https://github.com/mthcht/awesome-lists +*StageProxyOps*,*HTTP-Server.ps1*,,HTTP-Server,Persistence,offensive_tool,https://github.com/NullArray/WinBins-Plus/blob/1e4af04ceaa8085b532757a1331113e919a20f4b/Scripts/persist.cmd#L2,critical,N/A,https://github.com/mthcht/awesome-lists +\GoogleUpdatesTaskMachineUI,*fireeye.vbs*,,Helminth,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-oilrig-actors-provide-glimpse-development-testing-efforts/,high,N/A,https://github.com/mthcht/awesome-lists +\MicrosoftEdgeUpdateTaskMachineMS,*EdgeBrowser.cmd*,,MeshAgent,RAT,offensive_tool,https://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/securelist_com/awaken-likho-apt-new-implant-campaign_114101/content.txt#L831,high,N/A,https://github.com/mthcht/awesome-lists +\run1,*cmd.exe*,*/c *\ProgramData\*,BlackJack,Ransomware,offensive_tool,https://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/securelist_com/blackjack-hacktivists-connection-with-twelve_113959/content.txt#L1515,high,N/A,https://github.com/mthcht/awesome-lists +\SecurityAssist,*Certutil*,,OopsIE,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/,high,N/A,https://github.com/mthcht/awesome-lists +\mstask,*C:\temp\*,,Trojan.Win32.BreakWin,Malware,offensive_tool,https://www.sentinelone.com/labs/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll/,critical,N/A,https://github.com/mthcht/awesome-lists +\ReportHealth,*appdata*\srvHealth.exe*,,ISMInjector,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/,high,N/A,https://github.com/mthcht/awesome-lists +,*\Windows\Debug*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the *\Windows\Debug folder,https://github.com/mthcht/awesome-lists +\MicrosoftEdgeUpdateTaskMachineUC,*\users\public\*,,autohotkey,keylogger,offensive_tool,https://thedfirreport.com/2023/02/06/collect-exfiltrate-sleep-repeat/,high,N/A,https://github.com/mthcht/awesome-lists +,*\Users\public*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the Public user profile,https://github.com/mthcht/awesome-lists +,*\Users*\Downloads*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the users Downloads folder,https://github.com/mthcht/awesome-lists +,*\Users*\Documents*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the users Documents folder,https://github.com/mthcht/awesome-lists +,*\Users*\AppData\Roaming*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the roaming folder,https://github.com/mthcht/awesome-lists +,*\Users*\AppData\Local*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the appdata folder,https://github.com/mthcht/awesome-lists +\SystemFailureReporter,*\public\*,,SideTwist Backdoor (APT34),Malware,offensive_tool,https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/,critical,N/A,https://github.com/mthcht/awesome-lists +,*\ProgramData*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the ProgramData folder,https://github.com/mthcht/awesome-lists +\MEGA\MEGAsync Update Task*,*\MEGAupdater.exe,,MEGASync,Data Exfiltration,greyware_tool,https://mega.io/en/desktop,high,N/A,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/L-N/MEGAsync.csv +\WallPaperChangeApp,*\Autoit3\Autoit3.exe*,,OxtaRAT,Malware,offensive_tool,https://research.checkpoint.com/2023/operation-silent-watch-desktop-surveillance-in-azerbaijan-and-armenia/,critical,N/A,https://github.com/mthcht/awesome-lists +,*\AppData\Local\Temp\*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,high,task in the temp folder,https://github.com/mthcht/awesome-lists +\Microsoft_Auto_Scheduler,*\AppData\*,,Kube Ransomware,Ransomware,offensive_tool,https://x.com/ShanHolo/status/1880566701009563915/photo/1,high,N/A,https://github.com/mthcht/awesome-lists +,*:\Windows\Temp\*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,executable from the temp folder,https://github.com/mthcht/awesome-lists +,*:\windows\system32\calc.exe,,POC,exploitation,greyware_tool,https://x.com/hackingforbeer/status/1719402854085951883,medium,POC schtasks /create /sc minute /tn 'dongs' /tr 'C:\windows\system32\calc.exe',https://github.com/mthcht/awesome-lists +"\tMicNet Work40,",*.vbs*,,AsyncRAT,Malware,offensive_tool,https://any.run/cybersecurity-blog/asyncrat-open-directories-infection-analysis/,critical,AsyncRAT’s Infection samples,https://github.com/mthcht/awesome-lists +\yastcat,,,Wannamine,Cryptominer,offensive_tool,crowdstrike.com/blog/cryptomining-harmless-nuisance-disruptive-threat/,critical,Moonero miner - command SCHTASKS /create /RU System /SC DAILY /TN yastcat /f /TR %temp%\y1.bat &&SCHTASKS /run /TN yastcat,https://github.com/mthcht/awesome-lists +\OneNote 4726,,,Unkown,Malware,offensive_tool,https://x.com/Gi7w0rm/status/1864307803914981837,medium,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeAll,,,Trojan.Win32.BreakWin,Malware,offensive_tool,https://www.sentinelone.com/labs/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll/,critical,N/A,https://github.com/mthcht/awesome-lists +\dongs,,,suspicious names,exploitation,offensive_tool,https://x.com/hackingforbeer/status/1719402854085951883,medium,POC schtasks /create /sc minute /tn 'dongs' /tr 'C:\windows\system32\calc.exe',https://github.com/mthcht/awesome-lists +\StopVMMSandKillVMWP,,,StopVMMSandKillVMWP script,Defense evasion,offensive_tool,https://x.com/GroupIB_DFIR/status/1750452267692728516,high,schtasks /create /tn StopVMMSandKillVMWP /tr 'powershell.exe -Command get-service -name vmms | stop-service -force ; taskkill /f /im vmwp.exe' /sc minute /mo 30 /ru SYSTEM /f,https://github.com/mthcht/awesome-lists +\SSH Key Exchange,,,sshd,Persistence,greyware_tool,https://www.trellix.com/blogs/research/cactus-ransomware-new-strain-in-the-market/,medium,compliance,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/schtasks.csv +\SSH Server,,,sshd,Persistence,greyware_tool,https://www.trellix.com/blogs/research/cactus-ransomware-new-strain-in-the-market/,medium,compliance,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/schtasks.csv +\MeterpeterC2,,,redpill,exploitation,offensive_tool,https://github.com/r00t-3xp10it/redpill/blob/611d39b8bff717ac84d58550dc04e1b312acb19e/bin/SchTasks.ps1#L83,critical,SchTasks.ps1,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/redpill.csv +\RedPillTask,,,redpill,exploitation,offensive_tool,https://github.com/r00t-3xp10it/redpill/blob/611d39b8bff717ac84d58550dc04e1b312acb19e/redpill.ps1#L743,critical,redpill.ps1,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/redpill.csv +\SQLC2AgentPS*,,,PowerUpSQL,C2,offensive_tool,https://github.com/NetSPI/PowerUpSQL/blob/a83cad211983290bf38708e6e237cacbfe023e32/scripts/pending/SQLC2.ps1#L958,critical,N/A,https://github.com/mthcht/awesome-lists +My Startup Task,,,Powershell-Scripts-for-Hackers-and-Pentesters,Persistence,offensive_tool,https://github.com/Whitecat18/Powershell-Scripts-for-Hackers-and-Pentesters/blob/788e89e9584b4b43f982721d59c06c77c0b3b566/PS-020.md?plain=1#L20,medium,N/A,https://github.com/mthcht/awesome-lists +,,*Set-MpPreference -DisableRealtimeMonitoring *,powershell,Defense Evasion,greyware_tool,https://github.com/mthcht/awesome-lists,high,disabling Defender Real time monitoring,https://github.com/mthcht/awesome-lists +\OneDrive Security,,,Nitrogen,Malware,offensive_tool,https://news.sophos.com/en-us/2023/07/26/into-the-tank-with-nitrogen/,high,N/A,https://github.com/mthcht/awesome-lists +\Demovale,,,Nightdoor,Malware,offensive_tool,lhttps://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/www_welivesecurity_com/en_eset-research_evasive-panda-leverages-monlam-festival-target-tibetans/content.txt#L269C143-L269C152,high,N/A,https://github.com/mthcht/awesome-lists +\8766714F94DD,,,more_eggs,Malware,offensive_tool,https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/n=,high,N/A,https://github.com/mthcht/awesome-lists +\Loki,,,LokiLocker,Ransomware,offensive_tool,https://blogs.blackberry.com/en/2022/03/lokilocker-ransomware,critical,command observed schtasks /CREATE /SC ONLOGON /TN Loki /TR *,https://github.com/mthcht/awesome-lists +\LimeRAT-Admin,,,Lime-RAT,Malware,offensive_tool,https://github.com/NYAN-x-CAT/Lime-RAT/blob/87e189781c0aef0e84cabe2f8c2e7d8f5143e594/Project/Client/C_Installation.vb#L76,critical,N/A,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/L-N/Lime-RAT.csv +\NFUBffk,,,LemonDuck,Malware,offensive_tool,https://notes.netbytesec.com/2024/10/lemonduck-unleashes-cryptomining.html,high,N/A,https://github.com/mthcht/awesome-lists +\K0adic,,,koadic,C2,offensive_tool,https://github.com/Averroes/koadic/blob/97886ed570f31efff09d1e06c4a7ece2d9b6bd27/data/implant/persist/schtasks.js#L4C21-L4C27,critical,N/A,https://github.com/mthcht/awesome-lists +\Feedback_API_VS_Services_Client,,,Keyzetsu clipper variant,Malware,offensive_tool,https://checkmarx.com/blog/new-technique-to-trick-developers-detected-in-an-open-source-supply-chain-attack/,medium,N/A,https://github.com/mthcht/awesome-lists +\Tater,,,Invoke-Tater,Privilege Escalation,offensive_tool,https://github.com/BC-SECURITY/Empire/blob/8aca42747da6cf2b0def7edede94586f6b3258e8/empire/server/data/module_source/privesc/Invoke-Tater.ps1#L101,critical,PowerShell implementation of the Hot Potato Windows Privilege Escalation exploit from @breenmachine and @foxglovesec,https://github.com/mthcht/awesome-lists +\\Defender,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\defender,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\DefenderService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Application Experience\\StartupAppTaskCheck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Application Experience\\StartupAppTaskCkeck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\ATPUpd,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Data Integrity Scan\Data Integrity Update,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\DefenderUPDService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\IISUpdateService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Speech\\SpeechModelInstallTask,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\WiMSDFS,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Windows Defender\\Defender Update Service,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Windows Defender\\Service Update,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Windows Error Reporting\\CheckReporting,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Windows Error Reporting\\SubmitReporting,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Windows Filtering Platform\\BfeOnServiceStart,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\WindowsDefenderService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\WindowsDefenderService2,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\WindowsUpdate\\Scheduled AutoCheck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Check,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\WindowUpdate,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Defender,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\defender,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\DefenderService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Application Experience\StartupAppTaskCheck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Application Experience\StartupAppTaskCkeck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\ATPUpd,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Data Integrity Scan\Data Integrity Update,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\DefenderUPDService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\IISUpdateService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Speech\SpeechModelInstallTask,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\WiMSDFS,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Windows Defender\Defender Update Service,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Windows Defender\Service Update,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Windows Error Reporting\CheckReporting,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Windows Error Reporting\SubmitReporting,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStart,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\WindowsDefenderService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\WindowsDefenderService2,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\WindowsUpdate\Scheduled AutoCheck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\WindowsUpdate\Scheduled Check,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\WindowUpdate,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\InfrSiRfucture Technologies,,,Gootloader,Malware,offensive_tool,https://thedfirreport.com/2024/02/26/seo-poisoning-to-domain-control-the-gootloader-saga-continues/,critical,N/A,https://github.com/mthcht/awesome-lists +\SynchronizeTimeZone,,,frp,Data Exfiltration,offensive_tool,https://www.aha.org/system/files/media/file/2021/05/fbi-flash-tlp-white-apt-actors-exploiting-fortinet-vulnerabilities-to-gain-access-for-malicious-activity-5-27-21.pdf,high,APT Actors Exploiting Fortinet Vulnerabilities to Gain Access for Malicious Activity - creating specific scheduled task for exfiltration,https://github.com/mthcht/awesome-lists +\CursorSvc,,,Fentanyl Stealer,Malware,offensive_tool,https://github.com/dekrypted/Fentanyl/blob/2b4a008934f21df4eed7b90fb3019d3395f7c909/fenty.py#L699C53-L699C62,critical,Similar to Bandit Stealer,https://github.com/mthcht/awesome-lists +\DisableBitdefender-*,,,Dispossesor,Ransomware,offensive_tool,https://vx-underground.org/Archive/Dispossessor%20Leaks,high,N/A,https://github.com/mthcht/awesome-lists +\DHARMA,,,Dharma,Ransomware,offensive_tool,https://www.joesandbox.com/analysis/860608/0/lighthtml,critical,command observed schtasks /CREATE /SC ONLOGON /TN DHARMA /TR C:\ProgramData\harma.exe*,https://github.com/mthcht/awesome-lists +\Sorry,,,Cryptominer,Cryptominer,offensive_tool,https://x.com/cglyer/status/1001463072672886785,high,schtasks /create /tn 'Sorry' /tr C:\Windows\Temp\taskhost.exe /sc daily /mo 2 /st 22:00:00 /f4,https://x.com/cglyer/status/1001463072672886785 +\shadowdev,,,CobaltStrike,C2,offensive_tool,https://cloud.google.com/blog/topics/threat-intelligence/melting-unc2198-icedid-to-ransomware-operations,critical,cmd.exe /c schtasks /create /sc minute /mo 1 /tn shadowdev /tr C:\\ProgramData\\S\u0443sH\u0435\u0430ls\\T\u0430s\u0441host.exe,https://github.com/mthcht/awesome-lists +\ClearEventLogs,,,Cleareventlog script,Defense Evasion,offensive_tool,https://x.com/GroupIB_DFIR/status/1750452304606810175,high,schtasks /create /tn ClearEventLogs /tr 'powershell.exe -Command wevtutil el | foreach { wevtutil cl $_ }' /sc daily /st 03:00 /ru SYSTEM /f,https://github.com/mthcht/awesome-lists +\SC Scheduled Scan,,,Chafer,Malware,offensive_tool,https://nyotron.com/nyotron-discovers-next-generation-oilrig-attacks/,high,Chafer activity attributed to OilRig,https://github.com/mthcht/awesome-lists +\UpdatMachine,,,Chafer,Malware,offensive_tool,https://nyotron.com/nyotron-discovers-next-generation-oilrig-attacks/,high,Chafer activity attributed to OilRig,https://github.com/mthcht/awesome-lists +\drogon,,,BadRabbit,Malware,offensive_tool,https://www.vmray.com/analyses/bad-rabbit-ransomware-flash-analysis/report/overview.html,critical,schtasks /Create /SC once /TN drogon /RU SYSTEM /TR 'C:\Windows\system32\shutdown.exe /r /t 0 /f' /ST 02:34:00,https://github.com/mthcht/awesome-lists +\BaiduUpdateTask1,,,BADNEWS,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/,high,N/A,https://github.com/mthcht/awesome-lists +\AutoRDPwn,,,AutoRDPwn,C2,offensive_tool,https://github.com/JoelGMSec/AutoRDPwn/blob/839d6afbd2cfa64b01a188b4e09a3e079c9c81d3/AutoRDPwn.ps1#L678,critical,N/A,https://github.com/mthcht/awesome-lists +\thepiratMicrosoftEdgeUpdateTask,,,AsyncRAT,Malware,offensive_tool,https://any.run/cybersecurity-blog/asyncrat-open-directories-infection-analysis/,critical,AsyncRAT’s Infection samples,https://github.com/mthcht/awesome-lists +\kbnvmmmhjo,,,Agent Tesla,Malware,offensive_tool,https://isc.sans.edu/diary/PowerPoint+attachments+Agent+Tesla+and+code+reuse+in+malware/28154,critical,N/A,https://github.com/mthcht/awesome-lists \ No newline at end of file diff --git a/lookups/windows_suspicious_tasks.yml b/lookups/windows_suspicious_tasks.yml new file mode 100644 index 0000000000..68cc6d0fee --- /dev/null +++ b/lookups/windows_suspicious_tasks.yml @@ -0,0 +1,15 @@ +name: windows_suspicious_tasks +date: 2025-02-07 +version: 1 +id: 928cba69-be80-4601-9b0d-3ec81f714338 +author: Steven Dick +lookup_type: csv +description: A list of suspicious Windows Scheduled Task names and locations +default_match: false +match_type: +- WILDCARD(task_name) +- WILDCARD(task_command) +- WILDCARD(task_arguments) +min_matches: 1 +max_matches: 1 +case_sensitive_match: false \ No newline at end of file