Schedule VBS From Appdata

calendar May 3, 2021  ยท
Share on: linkedin copy

Schedule vb script From Appdata

Sigma rule (View on GitHub)

 1title: Schedule VBS From Appdata
 2status: experimental
 3description: Schedule vb script From Appdata
 4author: Joe Security
 5date: 2019-10-29
 6id: 200012
 7threatname:
 8behaviorgroup: 2
 9classification: 4
10mitreattack: T1053
11
12logsource:
13    category: process_creation
14    product: windows
15detection:
16    selection:
17        CommandLine:
18            - '*\schtasks.exe* /create *wscript /E:vbscript *\AppData\Roaming\\*'
19            - '*schtasks /create *\appdata\roaming\\*.vbs*'
20            - '*schtasks /create *\appdata\roaming\\*.js*'
21    condition: selection
22level: critical
to-top