Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor

 1title: Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor
 2id: 8fa65166-f463-4fd2-ad4f-1436133c52e1
 3related:
 4    - id: 2bfc1373-0220-4fbd-8b10-33ddafd2a142
 5      type: similar
 6status: test
 7description: Hunts for known SVR-specific scheduled task names
 8author: CISA
 9references:
10    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
11date: 2023-12-18
12tags:
13    - attack.persistence
14    - detection.emerging-threats
15logsource:
16    service: security
17    product: windows
18detection:
19    selection:
20        EventID:
21            - 4698
22            - 4699
23            - 4702
24        TaskName:
25            - '\defender'
26            - '\Microsoft\DefenderService'
27            - '\Microsoft\Windows\Application Experience\StartupAppTaskCheck'
28            - '\Microsoft\Windows\Application Experience\StartupAppTaskCkeck'
29            - '\Microsoft\Windows\ATPUpd'
30            - '\Microsoft\Windows\Data Integrity Scan\Data Integrity Update'
31            - '\Microsoft\Windows\DefenderUPDService'
32            - '\Microsoft\Windows\IISUpdateService'
33            - '\Microsoft\Windows\Speech\SpeechModelInstallTask'
34            - '\Microsoft\Windows\WiMSDFS'
35            - '\Microsoft\Windows\Windows Defender\Defender Update Service'
36            - '\Microsoft\Windows\Windows Defender\Service Update'
37            - '\Microsoft\Windows\Windows Error Reporting\CheckReporting'
38            - '\Microsoft\Windows\Windows Error Reporting\SubmitReporting'
39            - '\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStart'
40            - '\Microsoft\Windows\WindowsDefenderService'
41            - '\Microsoft\Windows\WindowsDefenderService2'
42            - '\Microsoft\Windows\WindowsUpdate\Scheduled AutoCheck'
43            - '\Microsoft\Windows\WindowsUpdate\Scheduled Check'
44            - '\WindowUpdate'
45    condition: selection
46falsepositives:
47    - Unknown
48level: high