name: Office Document Creating Schedule Task
id: cc8b7b74-9d0f-11eb-8342-acde48001122
version: 3
date: '2023-01-23'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
description: this search detects a potential malicious office document that create
  schedule task entry through macro VBA api or through loading taskschd.dll. This
  technique was seen in so many malicious macro malware that create persistence ,
  beaconing using task schedule malware entry The search will return the first time
  and last time the task was registered, as well as the `Command` to be executed,
  `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe
  is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following
  DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`.
  If found loaded by another process, it's possible a scheduled task is being registered
  within that process context in memory. Upon triage, identify the task scheduled
  source. Was it schtasks.exe or via TaskService? Review the job created and the Command
  to be executed. Capture any artifacts on disk and review. Identify any parallel
  processes within the same timeframe to identify source.'
search: '`sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe")
  ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime max(_time) as lastTime
  values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image parent_process_name
  ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `office_document_creating_schedule_task_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints.
  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
  Also be sure to include those monitored dll to your own sysmon config.
known_false_positives: unknown
references:
- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/
- https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
tags:
  analytic_story:
  - Spearphishing Attachments
  confidence: 70
  context:
  - Source:Endpoint
  - Stage:Execution
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log
  impact: 70
  kill_chain_phases:
  - Exploitation
  message: Office document creating a schedule task on $dest$
  mitre_attack_id:
  - T1566
  - T1566.001
  observable:
  - name: dest
    type: Endpoint
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - ImageLoaded
  - AllImageLoaded
  - Computer
  - EventCode
  - Image
  - process_name
  - ProcessId
  - ProcessGuid
  - _time
  risk_score: 49
  security_domain: endpoint
  asset_type: Endpoint