Query: detection rule: Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct da
Matching passage: Sigma rule: Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct da. Logsource: windows / process_creation. Rule: title: Disable Important Scheduled Task id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980 related: - id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad type: similar - id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d type: similar status: test description: Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-8---windows---disable-the-sr-scheduled-task - https://twitter.com/MichalKoczwara/status/1553634816016498688 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ author: frack113, Nasreddine Bencherchali (Nextron Systems), X__Junior date: 2021-12-26 modified: 2026-03-11 tags: - attack.impact - attack.t1489 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_cli_disable: CommandLine|contains|windash: /disable selection_cli_task: CommandLine|contains: - \Windows\BitLocker - \Windows\ExploitGuard - \Windows\ExploitGuard\ExploitGuard MDM policy Refresh - \Windows\SystemRestore\SR - \Windows\UpdateOrchestrator\ - \Windows\Windows Defender\ - \Windows\WindowsBackup\ - \Windows\WindowsUpdate\ condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_schtasks_disable/info.yml simulation: - type: atomic-red-team name: Windows - Disable the SR scheduled task technique: T1490 atomic_guid: 1c68c68d-83a4-4981-974e-8993055fa034
Near-miss passage: Sigma rule: Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disab. Logsource: windows / process_creation. Rule: title: Suspicious Manipulation Of Default Accounts Via Net.EXE id: 5b768e71-86f2-4879-b448-81061cbae951 status: test description: Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc references: - https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html - https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/ - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-01 modified: 2023-02-21 tags: - attack.collection - attack.t1560.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_user_option: CommandLine|contains: ' user ' selection_username: CommandLine|contains: - ' Järjestelmänvalvoja ' - ' Rendszergazda ' - ' Администратор ' - ' Administrateur ' - ' Administrador ' - ' Administratör ' - ' Administrator ' - ' guest ' - ' DefaultAccount ' - ' "Järjestelmänvalvoja" ' - ' "Rendszergazda" ' - ' "Администратор" ' - ' "Administrateur" ' - ' "Administrador" ' - ' "Administratör" ' - ' "Administrator" ' - ' "guest" ' - ' "DefaultAccount" ' - ' ''Järjestelmänvalvoja'' ' - ' ''Rendszergazda'' ' - ' ''Администратор'' ' - ' ''Administrateur'' ' - ' ''Administrador'' ' - ' ''Administratör'' ' - ' ''Administrator'' ' - ' ''guest'' ' - ' ''DefaultAccount'' ' filter: CommandLine|contains|all: - guest - /active no condition: all of selection_* and not filter falsepositives: - Some false positives could occur with the admin or guest account. It depends on the scripts being used by the admins in your env. If you experience a lot of FP you could reduce the level to medium level: high