Scheduled TaskCache Change by Uncommon Program

 1title: Scheduled TaskCache Change by Uncommon Program
 2id: 4720b7df-40c3-48fd-bbdf-fd4b3c464f0d
 3status: experimental
 4description: Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious
 5references:
 6    - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
 7    - https://labs.f-secure.com/blog/scheduled-task-tampering/
 8author: Syed Hasan (@syedhasan009)
 9date: 2021/06/18
10modified: 2023/08/17
11tags:
12    - attack.persistence
13    - attack.t1053
14    - attack.t1053.005
15logsource:
16    category: registry_set
17    product: windows
18detection:
19    selection:
20        TargetObject|contains: 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\'
21    filter:
22        TargetObject|contains:
23            - 'Microsoft\Windows\UpdateOrchestrator'
24            - 'Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask\Index'
25            - 'Microsoft\Windows\Flighting\OneSettings\RefreshCache\Index'
26    filter_tiworker:
27        Image|startswith: 'C:\Windows\'
28        Image|endswith: '\TiWorker.exe'
29    filter_svchost:
30        Image: 'C:\WINDOWS\system32\svchost.exe'
31    filter_ngen:
32        Image|startswith: 'C:\Windows\Microsoft.NET\Framework' # \Framework\ and \Framework64\
33        Image|endswith: '\ngen.exe'
34        TargetObject|contains:
35            - '\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B66B135D-DA06-4FC4-95F8-7458E1D10129}'
36            - '\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\.NET Framework\.NET Framework NGEN'
37    filter_office_click_to_run:
38        Image:
39            - 'C:\Program Files\Microsoft Office\root\Integration\Integrator.exe'
40            - 'C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe'
41    filter_msiexec:
42        Image: 'C:\Windows\System32\msiexec.exe'
43    filter_dropbox_updater:
44        Image:
45            - 'C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe'
46            - 'C:\Program Files\Dropbox\Update\DropboxUpdate.exe'
47    filter_explorer:
48        Image: 'C:\Windows\explorer.exe'
49        TargetObject|contains: '\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\PLA\Server Manager Performance Monitor\'
50    filter_system:
51        Image: 'System'
52    condition: selection and not 1 of filter*
53falsepositives:
54    - Unknown
55level: high