mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
76 lines
2.9 KiB
YAML
76 lines
2.9 KiB
YAML
name: Schedule Task with HTTP Command Arguments
|
|
id: 523c2684-a101-11eb-916b-acde48001122
|
|
version: 1
|
|
date: '2021-04-19'
|
|
author: Teoderick Contreras, Splunk
|
|
type: TTP
|
|
datamodel:
|
|
- Endpoint
|
|
description: The following query utilizes Windows Security EventCode 4698, `A scheduled
|
|
task was created`, to identify suspicious tasks registered on Windows either via
|
|
schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry
|
|
of malware or attack that uses lolbin to download other file or payload to the infected
|
|
machine. The search will return the first time and last time the task was registered,
|
|
as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether
|
|
it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and
|
|
`C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService
|
|
is launched -`taskschd.dll`. If found loaded by another process, it is possible
|
|
a scheduled task is being registered within that process context in memory. Upon
|
|
triage, identify the task scheduled source. Was it schtasks.exe or via TaskService?
|
|
Review the job created and the Command to be executed. Capture any artifacts on
|
|
disk and review. Identify any parallel processes within the same timeframe to identify
|
|
source.'
|
|
search: '`wineventlog_security` EventCode=4698 | xmlkv Message| search Arguments IN
|
|
("*http*") | stats count min(_time) as firstTime max(_time) as lastTime by dest,
|
|
Task_Name, Command, Author, Enabled, Hidden, Arguments | `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)` | `schedule_task_with_http_command_arguments_filter`'
|
|
how_to_implement: To successfully implement this search, you need to be ingesting
|
|
logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and
|
|
filter known instances of Task schedule used in your environment.
|
|
known_false_positives: unknown
|
|
references:
|
|
- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/
|
|
tags:
|
|
analytic_story:
|
|
- Windows Persistence Techniques
|
|
automated_detection_testing: passed
|
|
confidence: 90
|
|
context:
|
|
- source:endpoint
|
|
- stage: Execution
|
|
- Persistence
|
|
- Privilege Escalation
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/tasksched/windows-security.log
|
|
impact: 70
|
|
kill_chain_phases:
|
|
- Exploitation
|
|
message: A schedule task process commandline arguments $Arguments$ with http string
|
|
on it in host $dest$
|
|
mitre_attack_id:
|
|
- T1053
|
|
observable:
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: Arguments
|
|
type: Arguments
|
|
role:
|
|
- Attacker
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- dest
|
|
- Task_Name
|
|
- Command
|
|
- Author
|
|
- Enabled
|
|
- Hidden
|
|
- Arguments
|
|
risk_score: 63
|
|
security_domain: endpoint
|