Scheduled Task/Job detection rulesT1053

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

windows

Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers

windows · process_creation

Detects OilRig activity as reported by Nyotron in their March 2018 report

windows · process_creation

Detects OilRig registry persistence as reported by Nyotron in their March 2018 report

windows · registry_event

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

windows

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

windows

Detects commands used by Turla group as reported by ESET in May 2020

windows · process_creation

Detects execution of ChromeLoader malware via a registered scheduled task

windows · process_creation

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

windows · process_creation

Detects various execution patterns of the CrackMapExec pentesting framework

windows · process_creation

Detects the creation of a schtask via PowerSploit or Empire Default Configuration.

windows · process_creation

Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms

windows · process_creation

Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities

windows

Detects an interactive AT job, which may be used as a form of privilege escalation.

windows · process_creation

Detects Kapeka backdoor persistence activity. Depending on the process privileges, the Kapeka dropper then sets persistence for the backdoor either as a scheduled task (if admin or SYSTEM) or autorun registry (if not). For the scheduled task, it creates a scheduled task called "Sens Api" via schtasks command, which is set to run upon system startup as SYSTEM. To establish persistence through the autorun utility, it adds an autorun entry called "Sens Api" under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run via the "reg add" command. Both persistence mechanisms are set to launch the binary by calling rundll32 and passing the backdoor's first export ordinal (#1) without any additional argument.

windows · process_creation

Detects Kapeka backdoor scheduled task creation based on attributes such as paths, commands line flags, etc.

windows

Detects activity mentioned in Operation Wocao report

windows · process_creation

Detects activity mentioned in Operation Wocao report

windows

Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale

windows

Detects specific process parameters as used by ACTINIUM scheduled task persistence creation.

windows · process_creation

Detects potential exploitation of the BearLPE exploit using Task Scheduler ".job" import arbitrary DACL write\par

windows · process_creation

Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell "Get-Variable" technique as seen being used in Colibri Loader

windows · process_creation

Detects potential persistence behavior using the windows telemetry registry key. Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections. This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run. The problem is, it will run any arbitrary command without restriction of location or type.

windows · registry_set

Detects the creation of new scheduled tasks via commandline, using Schtasks.exe. This rule detects tasks creating that call OpenSSH, which may indicate the creation of reverse SSH tunnel to the attacker's server.

windows · process_creation

Detects remote RPC calls to create or execute a scheduled task via ATSvc

rpc_firewall · application

Detects remote RPC calls to create or execute a scheduled task

rpc_firewall · application

Detects remote RPC calls to create or execute a scheduled task via SASec

rpc_firewall · application

Detects the execution of renamed schtasks.exe binary, which is a legitimate Windows utility used for scheduling tasks. One of the very common persistence techniques is schedule malicious tasks using schtasks.exe. Since, it is heavily abused, it is also heavily monitored by security products. To evade detection, threat actors may rename the schtasks.exe binary to schedule their malicious tasks.

windows · process_creation

Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence.

windows · process_creation

Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.

windows · process_creation

Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious

windows · registry_set

Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges

windows · process_creation

Detects scheduled task creations that have suspicious action command and folder combinations

windows · process_creation

Detects post exploitation execution technique of the Serpent backdoor. According to Proofpoint, one of the commands that the backdoor ran was via creating a temporary scheduled task using an unusual method. It creates a fictitious windows event and a trigger in which once the event is created, it executes the payload.

windows · process_creation

Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands

windows · process_creation

Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspicious location Attackers can create a simple looking task in order to avoid detection on creation as it's often the most focused on Instead they modify the task after creation to include their malicious payload

windows · process_creation

Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.

windows

Detects the creation of scheduled tasks that involves a temporary folder and runs only once

windows · process_creation

Detects update to a scheduled task event that contain suspicious keywords.

windows

Detects the creation of tasks from processes executed from suspicious locations

windows · file_event

Detects the creation of a schtask that executes a file from C:\Users\<USER>\AppData\Local

windows · process_creation

Detects scheduled task creations or modification on a suspicious schedule type

windows · process_creation

Detects the creation of "ebpfbackdoor" files in both "cron.d" and "sudoers.d" directories. Which both are related to the TripleCross persistence method

linux · file_event

Detects scheduled task creation events that include suspicious actions, and is run once at 00:00

windows · process_creation

Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

azure

Modifications to a config that will serve an adversary's impacts or persistence

cisco

Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

windows · process_creation

Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

windows

Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE

zeek

Detects suspicious modification of crontab file.

linux

Detects manual execution of the "Microsoft Compatibility Appraiser" task via schtasks. In order to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.

windows · process_creation

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code

windows · ps_script

Detects remote task creation via at.exe or API interacting with ATSVC namedpipe

windows

Detects remote task creation via at.exe or API interacting with ATSVC namedpipe

zeek

Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware

windows · process_creation

Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.

linux · process_creation

Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.

macos · process_creation

Detects the execution of "schtasks.exe" from a parent that is located in a potentially suspicious location. Multiple malware strains were seen exhibiting a similar behavior in order to achieve persistence.

windows · process_creation

Detects the creation of a scheduled task using schtasks.exe, potentially in combination with curl for downloading payloads and PowerShell for executing them. This facilitates executing malicious payloads or connecting with C&C server persistently without dropping the malware sample on the host.

windows · process_creation

Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unusale program to be run from a Scheduled Task

windows

Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is an unusual program to be run from a Scheduled Task

windows

Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.

windows · process_creation

Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence

windows · process_creation

Detects creation of a scheduled task with a GUID like name

windows · process_creation

Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type

windows · process_creation

Detects the creation of cron files in Cron directories, which could indicate potential persistence mechanisms being established by an attacker. Note that not all cron file creations are malicious - legitimate system administration activities and software installations may also create cron files. This detection should be investigated in context, considering factors such as the user creating the file, the timing of creation, and the contents of the cron job. Focus investigation on unexpected cron files created by non-administrative users or during suspicious timeframes. Additionally, it is recommended to review the contents of the newly created cron files to assess their intent. Furthermore, it is suggested to baseline normal cron file creation and apply additional filters to reduce false positives based on the specific environment.

linux · file_event

Detects the creation of a scheduled task via file creation.

windows · file_event

Detects the creation of a scheduled task via Registry keys.

windows · registry_event

Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.

windows · process_creation

Detects scheduled task deletion events. Scheduled tasks are likely to be deleted if not used for persistence. Malicious Software often creates tasks directly under the root node e.g. \TASKNAME

windows

Detects the use of at/atd which are utilities that are used to schedule tasks. They are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious code

linux · process_creation

Detects the loading of the "taskschd.dll" module from a process that located in a potentially suspicious or uncommon directory. The loading of this DLL might indicate that the application have the capability to create a scheduled task via the "Schedule.Service" COM object. Investigation of the loading application and its behavior is required to determining if its malicious.

windows · image_load