Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor

 1title: Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor
 2id: 8fa65166-f463-4fd2-ad4f-1436133c52e1
 3related:
 4    - id: 2bfc1373-0220-4fbd-8b10-33ddafd2a142
 5      type: similar
 6status: experimental
 7description: Hunts for known SVR-specific scheduled task names
 8author: CISA
 9references:
10    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
11date: 2023/12/18
12tags:
13    - attack.persistence
14logsource:
15    service: security
16    product: windows
17detection:
18    selection:
19        EventID:
20            - 4698
21            - 4699
22            - 4702
23        TaskName:
24            - '\defender'
25            - '\Microsoft\DefenderService'
26            - '\Microsoft\Windows\Application Experience\StartupAppTaskCheck'
27            - '\Microsoft\Windows\Application Experience\StartupAppTaskCkeck'
28            - '\Microsoft\Windows\ATPUpd'
29            - '\Microsoft\Windows\Data Integrity Scan\Data Integrity Update'
30            - '\Microsoft\Windows\DefenderUPDService'
31            - '\Microsoft\Windows\IISUpdateService'
32            - '\Microsoft\Windows\Speech\SpeechModelInstallTask'
33            - '\Microsoft\Windows\WiMSDFS'
34            - '\Microsoft\Windows\Windows Defender\Defender Update Service'
35            - '\Microsoft\Windows\Windows Defender\Service Update'
36            - '\Microsoft\Windows\Windows Error Reporting\CheckReporting'
37            - '\Microsoft\Windows\Windows Error Reporting\SubmitReporting'
38            - '\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStart'
39            - '\Microsoft\Windows\WindowsDefenderService'
40            - '\Microsoft\Windows\WindowsDefenderService2'
41            - '\Microsoft\Windows\WindowsUpdate\Scheduled AutoCheck'
42            - '\Microsoft\Windows\WindowsUpdate\Scheduled Check'
43            - '\WindowUpdate'
44    condition: selection
45falsepositives:
46    - Unknown
47level: high