Query: detect Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svc in logs
Matching passage: Sigma rule: Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svc. Logsource: windows / registry_set. Rule: title: Scheduled TaskCache Change by Uncommon Program id: 4720b7df-40c3-48fd-bbdf-fd4b3c464f0d status: test description: Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious references: - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ - https://labs.f-secure.com/blog/scheduled-task-tampering/ author: Syed Hasan (@syedhasan009) date: 2021-06-18 modified: 2025-10-22 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053 - attack.t1053.005 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\ filter_main_empty: Details: (Empty) filter_main_null: Details: null filter_main_other: TargetObject|contains: - Microsoft\Windows\UpdateOrchestrator - Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask\Index - Microsoft\Windows\Flighting\OneSettings\RefreshCache\Index filter_main_mousocoreworker: Image|endswith: C:\Windows\System32\MoUsoCoreWorker.exe filter_main_services: Image|endswith: C:\Windows\System32\services.exe filter_main_tiworker: Image|startswith: C:\Windows\ Image|endswith: \TiWorker.exe filter_main_svchost: Image: C:\WINDOWS\system32\svchost.exe filter_main_ngen: Image|startswith: C:\Windows\Microsoft.NET\Framework Image|endswith: \ngen.exe TargetObject|contains: - \Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B66B135D-DA06-4FC4-95F8-7458E1D10129} - \Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\.NET Framework\.NET Framework NGEN filter_main_office: Image: - C:\Program Files\Microsoft Office\root\Integration\Integrator.exe - C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe - C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe - C:\Program Files (x86)\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe filter_main_msiexec: Image: C:\Windows\System32\msiexec.exe filter_main_explorer: Image: C:\Windows\explorer.exe TargetObject|contains: \Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\PLA\Server Manager Performance Monitor\ filter_main_system: Image: System filter_main_runtimebroker: Image: C:\Windows\System32\RuntimeBroker.exe filter_optional_dropbox_updater: Image: - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe - C:\Program Files\Dropbox\Update
Near-miss passage: Sigma rule: Detects when a user is removed from a privileged role. Bulk changes should be investigated.. Logsource: azure / auditlogs. Rule: title: Bulk Deletion Changes To Privileged Account Permissions id: 102e11e3-2db5-4c9e-bc26-357d42585d21 status: test description: Detects when a user is removed from a privileged role. Bulk changes should be investigated. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H' date: 2022-08-05 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: azure service: auditlogs detection: selection: properties.message: - Remove eligible member (permanent) - Remove eligible member (eligible) condition: selection falsepositives: - Legtimate administrator actions of removing members from a role level: high