Scheduled Tasks AT Command Enabled

 1[metadata]
 2creation_date = "2020/11/23"
 3integration = ["endpoint", "windows"]
 4maturity = "production"
 5updated_date = "2024/05/21"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies attempts to enable the Windows scheduled tasks AT command via the registry. Attackers may use this method to
11move laterally or persist locally. The AT command has been deprecated since Windows 8 and Windows Server 2012, but still
12exists for backwards compatibility.
13"""
14from = "now-9m"
15index = ["winlogbeat-*", "logs-endpoint.events.registry-*", "logs-windows.sysmon_operational-*", "endgame-*"]
16language = "eql"
17license = "Elastic License v2"
18name = "Scheduled Tasks AT Command Enabled"
19references = ["https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob"]
20risk_score = 47
21rule_id = "9aa0e1f6-52ce-42e1-abb3-09657cee2698"
22setup = """## Setup
23
24If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
25events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
26Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
27`event.ingested` to @timestamp.
28For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
29"""
30severity = "medium"
31tags = [
32    "Domain: Endpoint",
33    "OS: Windows",
34    "Use Case: Threat Detection",
35    "Tactic: Defense Evasion",
36    "Tactic: Execution",
37    "Data Source: Elastic Endgame",
38    "Data Source: Elastic Defend",
39    "Data Source: Sysmon",
40]
41timestamp_override = "event.ingested"
42type = "eql"
43
44query = '''
45registry where host.os.type == "windows" and
46  registry.path : (
47    "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Configuration\\EnableAt",
48    "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Configuration\\EnableAt"
49  ) and registry.data.strings : ("1", "0x00000001")
50'''
51
52
53[[rule.threat]]
54framework = "MITRE ATT&CK"
55[[rule.threat.technique]]
56id = "T1562"
57name = "Impair Defenses"
58reference = "https://attack.mitre.org/techniques/T1562/"
59[[rule.threat.technique.subtechnique]]
60id = "T1562.001"
61name = "Disable or Modify Tools"
62reference = "https://attack.mitre.org/techniques/T1562/001/"
63
64
65
66[rule.threat.tactic]
67id = "TA0005"
68name = "Defense Evasion"
69reference = "https://attack.mitre.org/tactics/TA0005/"
70[[rule.threat]]
71framework = "MITRE ATT&CK"
72[[rule.threat.technique]]
73id = "T1053"
74name = "Scheduled Task/Job"
75reference = "https://attack.mitre.org/techniques/T1053/"
76[[rule.threat.technique.subtechnique]]
77id = "T1053.002"
78name = "At"
79reference = "https://attack.mitre.org/techniques/T1053/002/"
80
81
82
83[rule.threat.tactic]
84id = "TA0002"
85name = "Execution"
86reference = "https://attack.mitre.org/tactics/TA0002/"