Query: rule covering Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspicious location Attackers
Matching passage: Sigma rule: Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspicious location Attackers. Logsource: windows / process_creation. Rule: title: Suspicious Modification Of Scheduled Tasks id: 1c0e41cd-21bb-4433-9acc-4a2cd6367b9b related: - id: 614cf376-6651-47c4-9dcc-6b9527f749f4 type: similar status: test description: 'Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspicious location Attackers can create a simple looking task in order to avoid detection on creation as it''s often the most focused on Instead they modify the task after creation to include their malicious payload ' references: - Internal Research - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-28 modified: 2022-11-18 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_schtasks: Image|endswith: \schtasks.exe CommandLine|contains|all: - ' /Change ' - ' /TN ' selection_susp_locations: CommandLine|contains: - \AppData\Local\Temp - \AppData\Roaming\ - \Users\Public\ - \WINDOWS\Temp\ - \Desktop\ - \Downloads\ - \Temporary Internet - C:\ProgramData\ - C:\Perflogs\ - '%ProgramData%' - '%appdata%' - '%comspec%' - '%localappdata%' selection_susp_images: CommandLine|contains: - regsvr32 - rundll32 - 'cmd /c ' - 'cmd /k ' - 'cmd /r ' - 'cmd.exe /c ' - 'cmd.exe /k ' - 'cmd.exe /r ' - powershell - mshta - wscript - cscript - certutil - bitsadmin - bash.exe - 'bash ' - scrcons - 'wmic ' - wmic.exe - forfiles - scriptrunner - hh.exe - 'hh ' condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Windows error reporting events where the process that crashed is LSASS (Local Security Authority Subsystem Servi. Logsource: windows / application. Rule: title: LSASS Process Crashed - Application id: a18e0862-127b-43ca-be12-1a542c75c7c5 status: experimental description: 'Detects Windows error reporting events where the process that crashed is LSASS (Local Security Authority Subsystem Service). This could be the cause of a provoked crash by techniques such as Lsass-Shtinkering to dump credentials. ' references: - https://github.com/deepinstinct/Lsass-Shtinkering - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-07 modified: 2025-12-03 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows service: application detection: selection: Provider_Name: Application Error EventID: 1000 AppName: lsass.exe ExceptionCode: c0000001 condition: selection falsepositives: - Rare legitimate crashing of the lsass process level: high