Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor - Task Scheduler

 1title: Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor - Task Scheduler
 2id: 2bfc1373-0220-4fbd-8b10-33ddafd2a142
 3related:
 4    - id: 8fa65166-f463-4fd2-ad4f-1436133c52e1 # Security-Audting Eventlog
 5      type: similar
 6status: experimental
 7description: Hunts for known SVR-specific scheduled task names
 8author: CISA
 9references:
10    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
11date: 2023-12-18
12tags:
13    - attack.persistence
14logsource:
15    product: windows
16    service: taskscheduler
17    definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger'
18detection:
19    selection:
20        EventID:
21            - 129 # Task Created
22            - 140 # Task Updated
23            - 141 # Task Deleted
24        TaskName:
25            - '\defender'
26            - '\Microsoft\DefenderService'
27            - '\Microsoft\Windows\Application Experience\StartupAppTaskCheck'
28            - '\Microsoft\Windows\Application Experience\StartupAppTaskCkeck'
29            - '\Microsoft\Windows\ATPUpd'
30            - '\Microsoft\Windows\Data Integrity Scan\Data Integrity Update'
31            - '\Microsoft\Windows\DefenderUPDService'
32            - '\Microsoft\Windows\IISUpdateService'
33            - '\Microsoft\Windows\Speech\SpeechModelInstallTask'
34            - '\Microsoft\Windows\WiMSDFS'
35            - '\Microsoft\Windows\Windows Defender\Defender Update Service'
36            - '\Microsoft\Windows\Windows Defender\Service Update'
37            - '\Microsoft\Windows\Windows Error Reporting\CheckReporting'
38            - '\Microsoft\Windows\Windows Error Reporting\SubmitReporting'
39            - '\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStart'
40            - '\Microsoft\Windows\WindowsDefenderService'
41            - '\Microsoft\Windows\WindowsDefenderService2'
42            - '\Microsoft\Windows\WindowsUpdate\Scheduled AutoCheck'
43            - '\Microsoft\Windows\WindowsUpdate\Scheduled Check'
44            - '\WindowUpdate'
45    condition: selection
46falsepositives:
47    - Unknown
48level: high