Remote Task Creation via ATSVC Named Pipe - Zeek

calendar Oct 18, 2023 · attack.lateral_movement attack.persistence car.2013-05-004 car.2015-04-001 attack.t1053.002  ·
Share on: linkedin copy

Detects remote task creation via at.exe or API interacting with ATSVC namedpipe

Sigma rule (View on GitHub)

 1title: Remote Task Creation via ATSVC Named Pipe - Zeek
 2id: dde85b37-40cd-4a94-b00c-0b8794f956b5
 3related:
 4    - id: f6de6525-4509-495a-8a82-1f8b0ed73a00
 5      type: derived
 6status: test
 7description: Detects remote task creation via at.exe or API interacting with ATSVC namedpipe
 8references:
 9    - https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html
10author: 'Samir Bousseaden, @neu5rn'
11date: 2020/04/03
12modified: 2022/12/27
13tags:
14    - attack.lateral_movement
15    - attack.persistence
16    - car.2013-05-004
17    - car.2015-04-001
18    - attack.t1053.002
19logsource:
20    product: zeek
21    service: smb_files
22detection:
23    selection:
24        path: '\\\*\IPC$'
25        name: 'atsvc'
26        # Accesses: '*WriteData*'
27    condition: selection
28falsepositives:
29    - Unknown
30level: medium

References

Related rules

to-top