Persistence and Execution at Scale via GPO Scheduled Task

calendar Oct 25, 2022 · attack.persistence attack.lateral_movement attack.t1053.005  ·
Share on: linkedin copy

Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale

Sigma rule (View on GitHub)

 1title: Persistence and Execution at Scale via GPO Scheduled Task
 2id: a8f29a7b-b137-4446-80a0-b804272f3da2
 3status: test
 4description: Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale
 5references:
 6    - https://twitter.com/menasec1/status/1106899890377052160
 7    - https://www.secureworks.com/blog/ransomware-as-a-distraction
 8author: Samir Bousseaden
 9date: 2019/04/03
10modified: 2021/11/27
11tags:
12    - attack.persistence
13    - attack.lateral_movement
14    - attack.t1053.005
15logsource:
16    product: windows
17    service: security
18    definition: 'The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure'
19detection:
20    selection:
21        EventID: 5145
22        ShareName: '\\\\\*\\SYSVOL' # looking for the string \\*\SYSVOL
23        RelativeTargetName|endswith: 'ScheduledTasks.xml'
24        Accesses|contains:
25            - 'WriteData'
26            - '%%4417'
27    condition: selection
28falsepositives:
29    - If the source IP is not localhost then it's super suspicious, better to monitor both local and remote changes to GPO scheduledtasks
30level: high

References

  • Something went wrong, but don’t fret — let’s give it another shot.


    Read More

  • Ransomware As a Distraction

    During a client engagement, Counter Threat Unit™ (CTU) analysts discovered the threat actor using a novel technique to distract responders.


    Read More

Related rules

to-top