Scheduled Task Executed Uncommon LOLBIN

 1title: Scheduled Task Executed Uncommon LOLBIN
 2id: f0767f15-0fb3-44b9-851e-e8d9a6d0005d
 3status: test
 4description: Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is an unusual program to be run from a Scheduled Task
 5references:
 6    - Internal Research
 7author: Nasreddine Bencherchali (Nextron Systems)
 8date: 2022-12-05
 9modified: 2023-02-07
10tags:
11    - attack.privilege-escalation
12    - attack.execution
13    - attack.persistence
14    - attack.t1053.005
15logsource:
16    product: windows
17    service: taskscheduler
18    definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger'
19detection:
20    selection:
21        EventID: 129 # Created Task Process
22        Path|endswith:
23            - '\calc.exe'
24            - '\cscript.exe'
25            - '\mshta.exe'
26            - '\mspaint.exe'
27            - '\notepad.exe'
28            - '\regsvr32.exe'
29            # - '\rundll32.exe'
30            - '\wscript.exe'
31    # filter_system:
32    #     Path|endswith: '\rundll32.exe'
33    #     TaskName|startswith: '\Microsoft\Windows\'
34    # condition: selection and not 1 of filter_*
35    condition: selection
36falsepositives:
37    - False positives may occur with some of the selected binaries if you have tasks using them (which could be very common in your environment). Exclude all the specific trusted tasks before using this rule
38level: medium