Remote Task Creation via ATSVC Named Pipe - Zeek

 1title: Remote Task Creation via ATSVC Named Pipe - Zeek
 2id: dde85b37-40cd-4a94-b00c-0b8794f956b5
 3related:
 4    - id: f6de6525-4509-495a-8a82-1f8b0ed73a00
 5      type: derived
 6status: test
 7description: Detects remote task creation via at.exe or API interacting with ATSVC namedpipe
 8references:
 9    - https://web.archive.org/web/20230409194125/https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html
10author: 'Samir Bousseaden, @neu5rn'
11date: 2020-04-03
12modified: 2022-12-27
13tags:
14    - attack.lateral-movement
15    - attack.persistence
16    - car.2013-05-004
17    - car.2015-04-001
18    - attack.t1053.002
19logsource:
20    product: zeek
21    service: smb_files
22detection:
23    selection:
24        path: '\\\*\IPC$'
25        name: 'atsvc'
26        # Accesses: '*WriteData*'
27    condition: selection
28falsepositives:
29    - Unknown
30level: medium

References

• Threat Hunting #25 - Scheduled Tasks for Persistence and/or Remote Execution

  

  The Task Scheduler enables you to automatically perform routine tasks on a chosen computer. The Task Scheduler does this by monitoring wha...

  
  Read More

Related rules

• Remote Task Creation via ATSVC Named Pipe
• OpenCanary - SSH Login Attempt
• OpenCanary - SSH New Connection Attempt
• PSEXEC Remote Execution File Artefact
• Password Provided In Command Line Of Net.EXE