Scheduled TaskCache Change by Uncommon Program

 1title: Scheduled TaskCache Change by Uncommon Program
 2id: 4720b7df-40c3-48fd-bbdf-fd4b3c464f0d
 3status: test
 4description: Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious
 5references:
 6    - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
 7    - https://labs.f-secure.com/blog/scheduled-task-tampering/
 8author: Syed Hasan (@syedhasan009)
 9date: 2021-06-18
10modified: 2025-07-04
11tags:
12    - attack.privilege-escalation
13    - attack.execution
14    - attack.persistence
15    - attack.t1053
16    - attack.t1053.005
17logsource:
18    category: registry_set
19    product: windows
20detection:
21    selection:
22        TargetObject|contains: 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\'
23    filter_main_other:
24        TargetObject|contains:
25            - 'Microsoft\Windows\UpdateOrchestrator'
26            - 'Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask\Index'
27            - 'Microsoft\Windows\Flighting\OneSettings\RefreshCache\Index'
28    filter_main_tiworker:
29        Image|startswith: 'C:\Windows\'
30        Image|endswith: '\TiWorker.exe'
31    filter_main_svchost:
32        Image: 'C:\WINDOWS\system32\svchost.exe'
33    filter_main_ngen:
34        Image|startswith: 'C:\Windows\Microsoft.NET\Framework' # \Framework\ and \Framework64\
35        Image|endswith: '\ngen.exe'
36        TargetObject|contains:
37            - '\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B66B135D-DA06-4FC4-95F8-7458E1D10129}'
38            - '\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\.NET Framework\.NET Framework NGEN'
39    filter_main_office_click_to_run:
40        Image:
41            - 'C:\Program Files\Microsoft Office\root\Integration\Integrator.exe'
42            - 'C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe'
43    filter_main_msiexec:
44        Image: 'C:\Windows\System32\msiexec.exe'
45    filter_main_explorer:
46        Image: 'C:\Windows\explorer.exe'
47        TargetObject|contains: '\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\PLA\Server Manager Performance Monitor\'
48    filter_main_system:
49        Image: 'System'
50    filter_main_runtimebroker:
51        Image: 'C:\Windows\System32\RuntimeBroker.exe'
52    filter_optional_dropbox_updater:
53        Image:
54            - 'C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe'
55            - 'C:\Program Files\Dropbox\Update\DropboxUpdate.exe'
56    filter_optional_edge:
57        Image|endswith: '\MicrosoftEdgeUpdate.exe'
58    condition: selection and not 1 of filter_*
59falsepositives:
60    - Unknown
61level: high