{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/tags/scheduled_task/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["Word","Excel","PowerPoint","Publisher","Access"],"_cs_severities":["low"],"_cs_tags":["persistence","execution","windows","image_load","scheduled_task"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eThis detection rule identifies a suspicious image load (\u003ccode\u003etaskschd.dll\u003c/code\u003e) originating from Microsoft Office applications (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE, MSPUB.EXE, MSACCESS.EXE). The behavior suggests potential adversarial activity involving the creation of scheduled tasks through the Windows Component Object Model (COM). Attackers may exploit this technique to establish persistence, circumventing traditional monitoring focused on the \u003ccode\u003eschtasks.exe\u003c/code\u003e utility. The use of COM for scheduled task management allows for stealthier operation and evasion of standard security controls, making it a valuable persistence mechanism for malicious actors. The rule is designed for data generated by Elastic Defend, Sysmon, and other endpoint detection platforms.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUser opens a malicious Microsoft Office document (e.g., Word, Excel).\u003c/li\u003e\n\u003cli\u003eThe document executes embedded macro code or exploits a vulnerability.\u003c/li\u003e\n\u003cli\u003eThe macro or exploit leverages the Component Object Model (COM).\u003c/li\u003e\n\u003cli\u003eThe Office application (e.g., WINWORD.EXE) loads the \u003ccode\u003etaskschd.dll\u003c/code\u003e library, providing access to the Task Scheduler service.\u003c/li\u003e\n\u003cli\u003eThe COM interface is used to programmatically create a new scheduled task.\u003c/li\u003e\n\u003cli\u003eThe scheduled task is configured to execute a malicious payload at a later time or on a recurring basis.\u003c/li\u003e\n\u003cli\u003eThe malicious payload could be a script, executable, or command-line instruction.\u003c/li\u003e\n\u003cli\u003eUpon execution, the payload achieves the attacker\u0026rsquo;s objective, such as establishing persistence, downloading additional malware, or compromising the system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eA successful attack leveraging this technique can allow adversaries to maintain persistent access to a compromised system. This can lead to long-term data exfiltration, lateral movement within the network, and deployment of ransomware. The low severity score assigned to the original rule may underestimate the potential impact, as persistence is a critical component of many advanced attacks. Affected systems may require extensive remediation to remove all traces of the malicious activity.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026ldquo;Office Application Loading Task Scheduler DLL\u0026rdquo; to your SIEM and tune for your environment to detect this specific activity.\u003c/li\u003e\n\u003cli\u003eEnable Sysmon Event ID 7 (Image Loaded) logging on Windows endpoints to provide visibility into DLL loading events, which is a prerequisite for the Sigma rule.\u003c/li\u003e\n\u003cli\u003eInvestigate any alerts generated by the Sigma rule, focusing on the specific scheduled tasks that are created and the payloads they execute.\u003c/li\u003e\n\u003cli\u003eMonitor for scheduled task creation events (Event ID 4698) and deletion events (Event ID 4699) in the Windows Event Logs, as referenced in the rule\u0026rsquo;s investigation guide.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-03T12:00:00Z","date_published":"2024-01-03T12:00:00Z","id":"/briefs/2024-01-suspicious-image-load-office/","summary":"Detection of taskschd.dll image loads from Microsoft Office applications indicates potential COM-based scheduled task creation for persistence, bypassing traditional schtasks.exe usage.","title":"Suspicious Image Load (taskschd.dll) from MS Office","url":"https://feed.craftedsignal.io/briefs/2024-01-suspicious-image-load-office/"},{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["Elastic Defend"],"_cs_severities":["low"],"_cs_tags":["persistence","windows","scheduled_task","attack.persistence"],"_cs_type":"advisory","_cs_vendors":["Elastic"],"content_html":"\u003cp\u003eAdversaries frequently abuse scheduled tasks in Windows to maintain persistence, move laterally within a network, or escalate privileges. This involves creating or modifying scheduled tasks to execute malicious commands or scripts at specific times or intervals. This detection rule focuses on identifying the creation of scheduled tasks by non-system accounts, which is often indicative of malicious activity. The rule specifically monitors for the execution of \u003ccode\u003eschtasks.exe\u003c/code\u003e with specific arguments related to task creation. It is designed to trigger when scheduled tasks are created by non-system level users, helping to filter out legitimate administrative activities. This is crucial for defenders because scheduled tasks provide a reliable and stealthy mechanism for attackers to maintain control over compromised systems.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains initial access to a Windows system through various means.\u003c/li\u003e\n\u003cli\u003eThe attacker executes a command shell (e.g., cmd.exe, PowerShell) or script interpreter (e.g., wscript.exe) on the compromised system.\u003c/li\u003e\n\u003cli\u003eThe attacker uses \u003ccode\u003eschtasks.exe\u003c/code\u003e with the \u003ccode\u003e/create\u003c/code\u003e parameter to create a new scheduled task.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003e/TN\u003c/code\u003e parameter is used to specify the name of the task, and the \u003ccode\u003e/TR\u003c/code\u003e parameter defines the program or script to execute.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003e/SC\u003c/code\u003e parameter sets the schedule for the task (e.g., daily, hourly, onlogon), and \u003ccode\u003e/RU\u003c/code\u003e specifies the user account under which the task will run.\u003c/li\u003e\n\u003cli\u003eThe attacker configures the task to run with elevated privileges or under a non-system account to bypass security controls.\u003c/li\u003e\n\u003cli\u003eThe scheduled task executes the attacker\u0026rsquo;s payload at the specified time or event, achieving persistence.\u003c/li\u003e\n\u003cli\u003eThe payload may perform various malicious actions, such as installing malware, exfiltrating data, or establishing a command and control channel.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation can lead to persistent access to the compromised system, allowing attackers to maintain control even after reboots or user logoffs. Attackers can leverage scheduled tasks to escalate privileges, potentially gaining access to sensitive data or critical system resources. The creation of unauthorized scheduled tasks can also be used to move laterally within the network, compromising additional systems and expanding the scope of the attack.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnable Sysmon process creation logging with Event ID 1 to capture command-line arguments and process details (reference: Sysmon setup in rule setup).\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026ldquo;Scheduled Task Creation by Non-System Account\u0026rdquo; to your SIEM to detect suspicious schtasks.exe activity.\u003c/li\u003e\n\u003cli\u003eReview and whitelist legitimate scheduled task creation activities in your environment to reduce false positives (reference: False positive analysis).\u003c/li\u003e\n\u003cli\u003eMonitor process activity for processes such as cmd.exe, powershell.exe, wscript.exe creating scheduled tasks (reference: query).\u003c/li\u003e\n\u003cli\u003eInvestigate any scheduled tasks created by non-system accounts that do not have a clear business justification (reference: Investigation Guide).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-02T12:00:00Z","date_published":"2024-01-02T12:00:00Z","id":"/briefs/2024-01-local-scheduled-task-creation/","summary":"This rule detects the creation of scheduled tasks on Windows systems by non-system accounts, a common technique used by adversaries for persistence, lateral movement, and privilege escalation.","title":"Suspicious Local Scheduled Task Creation","url":"https://feed.craftedsignal.io/briefs/2024-01-local-scheduled-task-creation/"},{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["Windows Security Event Logs","HPDeviceCheck","HP Support Assistant","HP Web Products Detection","Microsoft Visual Studio","OneDrive","Firefox","Office","Windows GroupPolicy"],"_cs_severities":["medium"],"_cs_tags":["persistence","scheduled_task","windows"],"_cs_type":"advisory","_cs_vendors":["Elastic","Hewlett-Packard","Microsoft","Google","Mozilla"],"content_html":"\u003cp\u003eAdversaries frequently abuse Windows scheduled tasks to establish persistence, move laterally within a network, and escalate privileges. This technique involves creating or modifying scheduled tasks to execute malicious code at specific times or in response to certain events. This detection rule identifies suspicious task creation by filtering out benign tasks and those initiated by system accounts, focusing on potential threats. The rule relies on Windows Security Event Logs, offering a valuable method for identifying unauthorized task creation indicative of malicious activity. The detection logic specifically excludes common tasks associated with software updates from vendors like Hewlett-Packard, Microsoft, Google, and Mozilla, as well as tasks run by system accounts.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains initial access to a system, potentially through phishing or exploiting a vulnerability.\u003c/li\u003e\n\u003cli\u003eThe attacker uses their initial access to execute commands, potentially leveraging PowerShell or cmd.exe.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the \u003ccode\u003eschtasks\u003c/code\u003e command-line utility or the COM interface to create a new scheduled task.\u003c/li\u003e\n\u003cli\u003eThe scheduled task is configured to execute a malicious payload, such as a reverse shell or a data exfiltration script.\u003c/li\u003e\n\u003cli\u003eThe task is set to trigger based on a specific schedule, such as at system startup, at a specific time, or upon a specific event.\u003c/li\u003e\n\u003cli\u003eWhen the trigger occurs, the scheduled task executes the malicious payload.\u003c/li\u003e\n\u003cli\u003eThe malicious payload establishes persistence, allowing the attacker to maintain access to the compromised system.\u003c/li\u003e\n\u003cli\u003eThe attacker can then use the persistent access to move laterally to other systems or to exfiltrate sensitive data.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows adversaries to maintain persistent access to compromised systems, potentially leading to data theft, system disruption, or further lateral movement within the network. By creating malicious scheduled tasks, attackers can ensure their code is executed even after a system reboot or user logoff. This can result in long-term compromise and significant damage to affected organizations. While the number of victims and specific sectors targeted are not detailed, the potential impact is broad due to the widespread use of Windows systems in enterprise environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnable Windows Security Event Logging and ensure that event ID 4698 (A scheduled task was created) is collected.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026ldquo;Suspicious Scheduled Task Creation via Winlog\u0026rdquo; to your SIEM to detect potentially malicious scheduled task creation events.\u003c/li\u003e\n\u003cli\u003eRegularly review and update the exclusion list in the Sigma rule to account for new benign scheduled tasks in your environment.\u003c/li\u003e\n\u003cli\u003eInvestigate any alerts generated by the Sigma rule by examining the task\u0026rsquo;s name, path, actions, and triggers to determine if they are suspicious.\u003c/li\u003e\n\u003cli\u003eMonitor for related suspicious activity, such as unusual process executions or network connections originating from the compromised system.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-02T12:00:00Z","date_published":"2024-01-02T12:00:00Z","id":"/briefs/2024-01-scheduled-task-creation/","summary":"This rule detects the creation of scheduled tasks in Windows using event logs, which adversaries may use for persistence, lateral movement, or privilege escalation by creating malicious tasks.","title":"Detecting Suspicious Scheduled Task Creation in Windows","url":"https://feed.craftedsignal.io/briefs/2024-01-scheduled-task-creation/"}],"language":"en","title":"CraftedSignal Threat Feed — Scheduled_task","version":"https://jsonfeed.org/version/1.1"}