Scheduled TaskCache Change by Uncommon Program

 1title: Scheduled TaskCache Change by Uncommon Program
 2id: 4720b7df-40c3-48fd-bbdf-fd4b3c464f0d
 3status: test
 4description: Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious
 5references:
 6    - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
 7    - https://labs.f-secure.com/blog/scheduled-task-tampering/
 8author: Syed Hasan (@syedhasan009)
 9date: 2021-06-18
10modified: 2025-10-22
11tags:
12    - attack.privilege-escalation
13    - attack.execution
14    - attack.persistence
15    - attack.t1053
16    - attack.t1053.005
17logsource:
18    category: registry_set
19    product: windows
20detection:
21    selection:
22        TargetObject|contains: 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\'
23    filter_main_empty:
24        Details: '(Empty)'
25    filter_main_null:
26        Details: null
27    filter_main_other:
28        TargetObject|contains:
29            - 'Microsoft\Windows\UpdateOrchestrator'
30            - 'Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask\Index'
31            - 'Microsoft\Windows\Flighting\OneSettings\RefreshCache\Index'
32    filter_main_mousocoreworker:
33        Image|endswith: 'C:\Windows\System32\MoUsoCoreWorker.exe'
34    filter_main_services:
35        Image|endswith: 'C:\Windows\System32\services.exe'
36    filter_main_tiworker:
37        Image|startswith: 'C:\Windows\'
38        Image|endswith: '\TiWorker.exe'
39    filter_main_svchost:
40        Image: 'C:\WINDOWS\system32\svchost.exe'
41    filter_main_ngen:
42        Image|startswith: 'C:\Windows\Microsoft.NET\Framework' # \Framework\ and \Framework64\
43        Image|endswith: '\ngen.exe'
44        TargetObject|contains:
45            - '\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B66B135D-DA06-4FC4-95F8-7458E1D10129}'
46            - '\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\.NET Framework\.NET Framework NGEN'
47    filter_main_office:
48        Image:
49            - 'C:\Program Files\Microsoft Office\root\Integration\Integrator.exe'
50            - 'C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe'
51            - 'C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe'
52            - 'C:\Program Files (x86)\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe'
53    filter_main_msiexec:
54        Image: 'C:\Windows\System32\msiexec.exe'
55    filter_main_explorer:
56        Image: 'C:\Windows\explorer.exe'
57        TargetObject|contains: '\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\PLA\Server Manager Performance Monitor\'
58    filter_main_system:
59        Image: 'System'
60    filter_main_runtimebroker:
61        Image: 'C:\Windows\System32\RuntimeBroker.exe'
62    filter_optional_dropbox_updater:
63        Image:
64            - 'C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe'
65            - 'C:\Program Files\Dropbox\Update\DropboxUpdate.exe'
66    filter_optional_edge:
67        Image|endswith:
68            - 'C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe'
69            - 'C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe'
70    filter_optional_onedrive:
71        Image|endswith:
72            - 'C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe'
73            - 'C:\Program Files\Microsoft OneDrive\OneDrive.exe'
74    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
75falsepositives:
76    - Unknown
77level: high