mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
68 lines
2.4 KiB
YAML
68 lines
2.4 KiB
YAML
name: Schedule Task with HTTP Command Arguments
|
|
id: 523c2684-a101-11eb-916b-acde48001122
|
|
version: 2
|
|
date: '2024-05-15'
|
|
author: Teoderick Contreras, Splunk
|
|
status: production
|
|
type: TTP
|
|
description: The following analytic detects the creation of scheduled tasks on Windows
|
|
systems that include HTTP command arguments, using Windows Security EventCode 4698.
|
|
It identifies tasks registered via schtasks.exe or TaskService with HTTP in their
|
|
command arguments. This behavior is significant as it often indicates malware activity
|
|
or the use of Living off the Land binaries (lolbins) to download additional payloads.
|
|
If confirmed malicious, this activity could lead to data exfiltration, malware propagation,
|
|
or unauthorized access to sensitive information, necessitating immediate investigation
|
|
and mitigation.
|
|
data_source:
|
|
- Windows Event Log Security 4698
|
|
search: '`wineventlog_security` EventCode=4698 | xmlkv Message| search Arguments IN
|
|
("*http*") | stats count min(_time) as firstTime max(_time) as lastTime by dest,
|
|
Task_Name, Command, Author, Enabled, Hidden, Arguments | `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)` | `schedule_task_with_http_command_arguments_filter`'
|
|
how_to_implement: To successfully implement this search, you need to be ingesting
|
|
logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and
|
|
filter known instances of Task schedule used in your environment.
|
|
known_false_positives: unknown
|
|
references:
|
|
- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/
|
|
tags:
|
|
analytic_story:
|
|
- Living Off The Land
|
|
- Winter Vivern
|
|
- Windows Persistence Techniques
|
|
- Scheduled Tasks
|
|
asset_type: Endpoint
|
|
confidence: 90
|
|
impact: 70
|
|
message: A schedule task process commandline arguments $Arguments$ with http string
|
|
on it in host $dest$
|
|
mitre_attack_id:
|
|
- T1053
|
|
observable:
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- dest
|
|
- Task_Name
|
|
- Command
|
|
- Author
|
|
- Enabled
|
|
- Hidden
|
|
- Arguments
|
|
risk_score: 63
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data:
|
|
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/tasksched/windows-security.log
|
|
source: WinEventLog:Security
|
|
sourcetype: WinEventLog
|