Removal Of SD Value to Hide Schedule Task - Registry

 1title: Removal Of SD Value to Hide Schedule Task - Registry
 2id: acd74772-5f88-45c7-956b-6a7b36c294d2
 3related:
 4    - id: 526cc8bc-1cdc-48ad-8b26-f19bff969cec
 5      type: similar
 6status: test
 7description: Remove SD (Security Descriptor) value in \Schedule\TaskCache\Tree registry hive to hide schedule task. This technique is used by Tarrask malware
 8references:
 9    - https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/
10author: Sittikorn S
11date: 2022/04/15
12modified: 2023/02/08
13tags:
14    - attack.defense_evasion
15    - attack.t1562
16logsource:
17    product: windows
18    category: registry_delete
19detection:
20    selection:
21        EventType: DeleteKey
22        TargetObject|contains|all:
23            - '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\'
24            - 'SD'
25    condition: selection
26falsepositives:
27    - Unknown
28level: medium