Scheduled Task Execution at Scale via GPO

Detects the modification of Group Policy Object attributes to execute a scheduled task in the objects controlled by the GPO.

Elastic rule (View on GitHub)

 1[metadata]
 2creation_date = "2021/11/08"
 3integration = ["system", "windows"]
 4maturity = "production"
 5updated_date = "2024/08/09"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Detects the modification of Group Policy Object attributes to execute a scheduled task in the objects controlled by the
11GPO.
12"""
13index = ["winlogbeat-*", "logs-system.*", "logs-windows.*"]
14language = "eql"
15license = "Elastic License v2"
16name = "Scheduled Task Execution at Scale via GPO"
17note = """## Triage and analysis
18
19### Investigating Scheduled Task Execution at Scale via GPO
20
21Group Policy Objects (GPOs) can be used by attackers to execute scheduled tasks at scale to compromise objects controlled by a given GPO. This is done by changing the contents of the `<GPOPath>\\Machine\\Preferences\\ScheduledTasks\\ScheduledTasks.xml` file.
22
23#### Possible investigation steps
24
25- This attack abuses a legitimate mechanism of Active Directory, so it is important to determine whether the activity is legitimate and the administrator is authorized to perform this operation.
26- Retrieve the contents of the `ScheduledTasks.xml` file, and check the `<Command>` and `<Arguments>` XML tags for any potentially malicious commands or binaries.
27- Investigate other alerts associated with the user/host during the past 48 hours.
28- Scope which objects may be compromised by retrieving information about which objects are controlled by the GPO.
29
30### False positive analysis
31
32- Verify if the execution is allowed and done under change management, and if the execution is legitimate.
33
34### Related rules
35
36- Group Policy Abuse for Privilege Addition - b9554892-5e0e-424b-83a0-5aef95aa43bf
37- Startup/Logon Script added to Group Policy Object - 16fac1a1-21ee-4ca6-b720-458e3855d046
38
39### Response and remediation
40
41- Initiate the incident response process based on the outcome of the triage.
42- The investigation and containment must be performed in every computer controlled by the GPO, where necessary.
43- Remove the script from the GPO.
44- Check if other GPOs have suspicious scheduled tasks attached.
45- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
46- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
47"""
48references = [
49    "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0025_windows_audit_directory_service_changes.md",
50    "https://github.com/atc-project/atc-data/blob/f2bbb51ecf68e2c9f488e3c70dcdd3df51d2a46b/docs/Logging_Policies/LP_0029_windows_audit_detailed_file_share.md",
51    "https://labs.f-secure.com/tools/sharpgpoabuse",
52    "https://twitter.com/menasec1/status/1106899890377052160",
53    "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_gpo_scheduledtasks.yml",
54]
55risk_score = 47
56rule_id = "15a8ba77-1c13-4274-88fe-6bd14133861e"
57setup = """## Setup
58
59The 'Audit Detailed File Share' audit policy must be configured (Success Failure).
60Steps to implement the logging policy with Advanced Audit Configuration:

Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policies Configuration > Audit Policies > Object Access > Audit Detailed File Share (Success,Failure)

1
2The 'Audit Directory Service Changes' audit policy must be configured (Success Failure).
3Steps to implement the logging policy with Advanced Audit Configuration:

Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policies Configuration > Audit Policies > DS Access > Audit Directory Service Changes (Success,Failure)

 1"""
 2severity = "medium"
 3tags = [
 4    "Domain: Endpoint",
 5    "OS: Windows",
 6    "Use Case: Threat Detection",
 7    "Tactic: Privilege Escalation",
 8    "Tactic: Lateral Movement",
 9    "Data Source: Active Directory",
10    "Resources: Investigation Guide",
11    "Use Case: Active Directory Monitoring",
12    "Data Source: System",
13]
14timestamp_override = "event.ingested"
15type = "eql"
16
17query = '''
18any where host.os.type == "windows" and event.code in ("5136", "5145") and
19(
20  (
21    winlog.event_data.AttributeLDAPDisplayName : (
22      "gPCMachineExtensionNames",
23      "gPCUserExtensionNames"
24    ) and
25    winlog.event_data.AttributeValue : "*CAB54552-DEEA-4691-817E-ED4A4D1AFC72*" and
26    winlog.event_data.AttributeValue : "*AADCED64-746C-4633-A97C-D61349046527*"
27  ) or
28  (
29    winlog.event_data.ShareName : "\\\\*\\SYSVOL" and
30    winlog.event_data.RelativeTargetName : "*ScheduledTasks.xml" and
31    winlog.event_data.AccessList:"*%%4417*"
32  )
33)
34'''
35
36
37[[rule.threat]]
38framework = "MITRE ATT&CK"
39[[rule.threat.technique]]
40id = "T1053"
41name = "Scheduled Task/Job"
42reference = "https://attack.mitre.org/techniques/T1053/"
43[[rule.threat.technique.subtechnique]]
44id = "T1053.005"
45name = "Scheduled Task"
46reference = "https://attack.mitre.org/techniques/T1053/005/"
47
48
49[[rule.threat.technique]]
50id = "T1484"
51name = "Domain or Tenant Policy Modification"
52reference = "https://attack.mitre.org/techniques/T1484/"
53[[rule.threat.technique.subtechnique]]
54id = "T1484.001"
55name = "Group Policy Modification"
56reference = "https://attack.mitre.org/techniques/T1484/001/"
57
58
59
60[rule.threat.tactic]
61id = "TA0004"
62name = "Privilege Escalation"
63reference = "https://attack.mitre.org/tactics/TA0004/"
64[[rule.threat]]
65framework = "MITRE ATT&CK"
66[[rule.threat.technique]]
67id = "T1570"
68name = "Lateral Tool Transfer"
69reference = "https://attack.mitre.org/techniques/T1570/"
70
71
72[rule.threat.tactic]
73id = "TA0008"
74name = "Lateral Movement"
75reference = "https://attack.mitre.org/tactics/TA0008/"

Triage and analysis

Investigating Scheduled Task Execution at Scale via GPO

Group Policy Objects (GPOs) can be used by attackers to execute scheduled tasks at scale to compromise objects controlled by a given GPO. This is done by changing the contents of the <GPOPath>\Machine\Preferences\ScheduledTasks\ScheduledTasks.xml file.

Possible investigation steps

  • This attack abuses a legitimate mechanism of Active Directory, so it is important to determine whether the activity is legitimate and the administrator is authorized to perform this operation.
  • Retrieve the contents of the ScheduledTasks.xml file, and check the <Command> and <Arguments> XML tags for any potentially malicious commands or binaries.
  • Investigate other alerts associated with the user/host during the past 48 hours.
  • Scope which objects may be compromised by retrieving information about which objects are controlled by the GPO.

False positive analysis

  • Verify if the execution is allowed and done under change management, and if the execution is legitimate.
  • Group Policy Abuse for Privilege Addition - b9554892-5e0e-424b-83a0-5aef95aa43bf
  • Startup/Logon Script added to Group Policy Object - 16fac1a1-21ee-4ca6-b720-458e3855d046

Response and remediation

  • Initiate the incident response process based on the outcome of the triage.
  • The investigation and containment must be performed in every computer controlled by the GPO, where necessary.
  • Remove the script from the GPO.
  • Check if other GPOs have suspicious scheduled tasks attached.
  • Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
  • Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).

References

Related rules

to-top