Powershell Create Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code
Sigma rule (View on GitHub)
1title: Powershell Create Scheduled Task
2id: 363eccc0-279a-4ccf-a3ab-24c2e63b11fb
3status: test
4description: Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code
5references:
6 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.005/T1053.005.md#atomic-test-4---powershell-cmdlet-scheduled-task
7 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.005/T1053.005.md#atomic-test-6---wmi-invoke-cimmethod-scheduled-task
8author: frack113
9date: 2021/12/28
10tags:
11 - attack.persistence
12 - attack.t1053.005
13logsource:
14 product: windows
15 category: ps_script
16 definition: 'Requirements: Script Block Logging must be enabled'
17detection:
18 selection_cmdlet:
19 ScriptBlockText|contains:
20 - 'New-ScheduledTaskAction'
21 - 'New-ScheduledTaskTrigger'
22 - 'New-ScheduledTaskPrincipal'
23 - 'New-ScheduledTaskSettingsSet'
24 - 'New-ScheduledTask'
25 - 'Register-ScheduledTask'
26 selection_cimmethod:
27 ScriptBlockText|contains|all:
28 - 'Invoke-CimMethod'
29 - '-ClassName'
30 - 'PS_ScheduledTask'
31 - '-NameSpace'
32 - 'Root\Microsoft\Windows\TaskScheduler'
33 condition: 1 of selection_*
34falsepositives:
35 - Unknown
36level: medium
References
-
Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team
Read More -
Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team
Read More
Related rules
- Scheduled task executing powershell encoded payload from registry
- Suspicious Schtasks Child Process
- Windows Scheduled Task Behaving Improperly or Suspiciously
- Windows Scheduled Task Create Shell
- Windows Scheduled Task Making Suspicious Network Connection