mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
66 lines
3.5 KiB
YAML
66 lines
3.5 KiB
YAML
name: Schedule Task with HTTP Command Arguments
|
|
id: 523c2684-a101-11eb-916b-acde48001122
|
|
version: 1
|
|
date: '2023-04-05'
|
|
author: Teoderick Contreras, Splunk
|
|
status: production
|
|
type: TTP
|
|
description: The following analytic detects the registration of suspicious tasks on Windows using the Windows Security EventCode 4698, "A scheduled task was created." It specifically looks for tasks registered through schtasks.exe or TaskService that have command arguments containing the string "HTTP." This behavior is often associated with malware or attacks that utilize Living off the Land binaries (lolbins) to download additional files or payloads to the compromised machine.\
|
|
|
|
The search returns information about the task, such as the task name, command, author, enabled status, hidden status, and arguments. Upon triage, it is important to identify the source of the scheduled task, whether it was registered through schtasks.exe or TaskService. Review the details of the created task and the command to be executed. Capture relevant artifacts on disk and examine them. Additionally, identify any parallel processes occurring within the same timeframe to determine the source of the attack.\
|
|
|
|
Implementing this analytic requires ingesting logs with information about task schedules, specifically Windows Security Log EventCode 4698, from your endpoints. It is recommended to tune and filter known instances of task schedules used in your environment to minimize false positives.\
|
|
|
|
Detecting the registration of suspicious tasks with HTTP command arguments is valuable for a SOC as it indicates potential malicious activity or an attempt to establish persistence on the system. If a true positive is found, further investigation is warranted to analyze the nature and purpose of the scheduled task, identify any downloaded files or payloads, and mitigate the associated risks. The impact of a true positive can vary but may include data exfiltration, malware propagation, or unauthorized access to sensitive information.
|
|
data_source:
|
|
- Windows Security 4698
|
|
search: '`wineventlog_security` EventCode=4698 | xmlkv Message| search Arguments IN
|
|
("*http*") | stats count min(_time) as firstTime max(_time) as lastTime by dest,
|
|
Task_Name, Command, Author, Enabled, Hidden, Arguments | `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)` | `schedule_task_with_http_command_arguments_filter`'
|
|
how_to_implement: To successfully implement this search, you need to be ingesting
|
|
logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and
|
|
filter known instances of Task schedule used in your environment.
|
|
known_false_positives: unknown
|
|
references:
|
|
- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/
|
|
tags:
|
|
analytic_story:
|
|
- Living Off The Land
|
|
- Winter Vivern
|
|
- Windows Persistence Techniques
|
|
- Scheduled Tasks
|
|
asset_type: Endpoint
|
|
confidence: 90
|
|
impact: 70
|
|
message: A schedule task process commandline arguments $Arguments$ with http string
|
|
on it in host $dest$
|
|
mitre_attack_id:
|
|
- T1053
|
|
observable:
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- dest
|
|
- Task_Name
|
|
- Command
|
|
- Author
|
|
- Enabled
|
|
- Hidden
|
|
- Arguments
|
|
risk_score: 63
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/tasksched/windows-security.log
|
|
source: WinEventLog:Security
|
|
sourcetype: WinEventLog
|