mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
tccontre
72 lines
2.8 KiB
YAML
72 lines
2.8 KiB
YAML
name: Schedule Task with HTTP Command Arguments
|
|
id: 523c2684-a101-11eb-916b-acde48001122
|
|
version: 1
|
|
date: '2023-04-05'
|
|
author: Teoderick Contreras, Splunk
|
|
status: production
|
|
type: TTP
|
|
description: The following query utilizes Windows Security EventCode 4698, `A scheduled
|
|
task was created`, to identify suspicious tasks registered on Windows either via
|
|
schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry
|
|
of malware or attack that uses lolbin to download other file or payload to the infected
|
|
machine. The search will return the first time and last time the task was registered,
|
|
as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether
|
|
it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and
|
|
`C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService
|
|
is launched -`taskschd.dll`. If found loaded by another process, it is possible
|
|
a scheduled task is being registered within that process context in memory. Upon
|
|
triage, identify the task scheduled source. Was it schtasks.exe or via TaskService?
|
|
Review the job created and the Command to be executed. Capture any artifacts on
|
|
disk and review. Identify any parallel processes within the same timeframe to identify
|
|
source.'
|
|
data_source:
|
|
- Windows Security 4698
|
|
search: '`wineventlog_security` EventCode=4698 | xmlkv Message| search Arguments IN
|
|
("*http*") | stats count min(_time) as firstTime max(_time) as lastTime by dest,
|
|
Task_Name, Command, Author, Enabled, Hidden, Arguments | `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)` | `schedule_task_with_http_command_arguments_filter`'
|
|
how_to_implement: To successfully implement this search, you need to be ingesting
|
|
logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and
|
|
filter known instances of Task schedule used in your environment.
|
|
known_false_positives: unknown
|
|
references:
|
|
- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/
|
|
tags:
|
|
analytic_story:
|
|
- Living Off The Land
|
|
- Winter Vivern
|
|
- Windows Persistence Techniques
|
|
asset_type: Endpoint
|
|
confidence: 90
|
|
impact: 70
|
|
message: A schedule task process commandline arguments $Arguments$ with http string
|
|
on it in host $dest$
|
|
mitre_attack_id:
|
|
- T1053
|
|
observable:
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- dest
|
|
- Task_Name
|
|
- Command
|
|
- Author
|
|
- Enabled
|
|
- Hidden
|
|
- Arguments
|
|
risk_score: 63
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/tasksched/windows-security.log
|
|
source: WinEventLog:Security
|
|
sourcetype: WinEventLog
|