Persistence via TelemetryController Scheduled Task Hijack

 1[metadata]
 2creation_date = "2020/08/17"
 3integration = ["endpoint", "windows", "system"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2024/03/28"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Detects the successful hijack of Microsoft Compatibility Appraiser scheduled task to establish persistence with an
13integrity level of system.
14"""
15from = "now-9m"
16index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
17language = "eql"
18license = "Elastic License v2"
19name = "Persistence via TelemetryController Scheduled Task Hijack"
20references = [
21    "https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence",
22]
23risk_score = 73
24rule_id = "68921d85-d0dc-48b3-865f-43291ca2c4f2"
25setup = """## Setup
26
27If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
28events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
29Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
30`event.ingested` to @timestamp.
31For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
32"""
33severity = "high"
34tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"]
35timestamp_override = "event.ingested"
36type = "eql"
37
38query = '''
39process where host.os.type == "windows" and event.type == "start" and
40  process.parent.name : "CompatTelRunner.exe" and process.args : "-cv*" and
41  not process.name : ("conhost.exe",
42                      "DeviceCensus.exe",
43                      "CompatTelRunner.exe",
44                      "DismHost.exe",
45                      "rundll32.exe",
46                      "powershell.exe")
47'''
48
49
50[[rule.threat]]
51framework = "MITRE ATT&CK"
52[[rule.threat.technique]]
53id = "T1053"
54name = "Scheduled Task/Job"
55reference = "https://attack.mitre.org/techniques/T1053/"
56[[rule.threat.technique.subtechnique]]
57id = "T1053.005"
58name = "Scheduled Task"
59reference = "https://attack.mitre.org/techniques/T1053/005/"
60
61
62[[rule.threat.technique]]
63id = "T1574"
64name = "Hijack Execution Flow"
65reference = "https://attack.mitre.org/techniques/T1574/"
66
67[rule.threat.tactic]
68id = "TA0003"
69name = "Persistence"
70reference = "https://attack.mitre.org/tactics/TA0003/"
71
72[[rule.threat]]
73framework = "MITRE ATT&CK"
74
75[[rule.threat.technique]]
76id = "T1053"
77name = "Scheduled Task/Job"
78reference = "https://attack.mitre.org/techniques/T1053/"
79[[rule.threat.technique.subtechnique]]
80id = "T1053.005"
81name = "Scheduled Task"
82reference = "https://attack.mitre.org/techniques/T1053/005/"
83
84[[rule.threat.technique]]
85id = "T1574"
86name = "Hijack Execution Flow"
87reference = "https://attack.mitre.org/techniques/T1574/"
88
89
90
91[rule.threat.tactic]
92id = "TA0004"
93name = "Privilege Escalation"
94reference = "https://attack.mitre.org/tactics/TA0004/"