Situational AwarenessCAR-2020-09-001

Scheduled Task - FileAccess

Hypothesis and description

In order to gain persistence, privilege escalation, or remote execution, an adversary may use the Windows Task Scheduler to schedule a command to be run at a specified time, date, and even host. Task Scheduler stores tasks as files in two locations - C:\Windows\Tasks (legacy) or C:\Windows\System32\Tasks. Accordingly, this analytic looks for the creation of task files in these two locations.

Platforms: Windows
Domain: Host
Subtypes: File
Submitted: 2020-09-10
Contributors: Olaf Hartong

ATT&CK coverage

Technique	Tactics	Coverage
T1053 Scheduled Task/JobT1053.005	Execution, Persistence, Privilege Escalation	Low

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1053Scheduled Task/Job
.005 Scheduled Task

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

D3FEND techniques MITRE maps to this analytic

D3-FCA File Creation Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

PseudocodePseudocode - Windows task file creationData model: CAR native

This is a pseudocode representation of the below splunk search.

files = search File:Create
task_files = filter files where (
  (file_path = "C:\Windows\System32\Tasks\*" or file_path = "C:\Windows\Tasks\*")  and
  image_path != "C:\WINDOWS\system32\svchost.exe")
output task_files

SplunkSplunk search - Windows task file creationData model: Sysmon native

This Splunk search looks for any files created under the Windows tasks directories.

index=__your_sysmon_index__ EventCode=11 Image!="C:\\WINDOWS\\system32\\svchost.exe" (TargetFilename="C:\\Windows\\System32\\Tasks\\
*" OR TargetFilename="C:\\Windows\\Tasks\\*")

LogPointLogPoint search - Windows task file creationData model: LogPoint native

This LogPoint search looks for any files created under the Windows tasks directories.

norm_id=WindowsSysmon event_id=11 -source_image="C:\WINDOWS\system32\svchost.exe" (path="C:\Windows\System32\Tasks*" OR path="C:\Windows\Tasks*")

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

15 more in the full list

View CAR-2020-09-001 on car.mitre.org