Query: Sigma rule for Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any too
Matching passage: Sigma rule: Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any too. Logsource: windows / registry_set. Rule: title: Hide Schedule Task Via Index Value Tamper id: 5b16df71-8615-4f7f-ac9b-6c43c0509e61 related: - id: acd74772-5f88-45c7-956b-6a7b36c294d2 type: similar - id: 526cc8bc-1cdc-48ad-8b26-f19bff969cec type: similar status: test description: 'Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique) ' references: - https://blog.qualys.com/vulnerabilities-threat-research/2022/06/20/defending-against-scheduled-task-attacks-in-windows-environments author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-26 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|contains|all: - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ - Index Details: DWORD (0x00000000) condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation. Logsource: macos / process_creation. Rule: title: Suspicious Browser Child Process - MacOS id: 0250638a-2b28-4541-86fc-ea4c558fa0c6 status: test description: Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation. references: - https://fr.slideshare.net/codeblue_jp/cb19-recent-apt-attack-on-crypto-exchange-employees-by-heungsoo-kang - https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_initial_access_suspicious_browser_childproc.toml author: Sohan G (D4rkCiph3r) date: 2023-04-05 tags: - attack.initial-access - attack.execution - attack.t1189 - attack.t1203 - attack.t1059 logsource: category: process_creation product: macos detection: selection: ParentImage|contains: - com.apple.WebKit.WebContent - firefox - Google Chrome Helper - Google Chrome - Microsoft Edge - Opera - Safari - Tor Browser Image|endswith: - /bash - /curl - /dash - /ksh - /osascript - /perl - /php - /pwsh - /python - /sh - /tcsh - /wget - /zsh filter_main_generic: CommandLine|contains: --defaults-torrc filter_main_ms_autoupdate: CommandLine|contains: /Library/Application Support/Microsoft/MAU*/Microsoft AutoUpdate.app/Contents/MacOS/msupdate filter_main_chrome: ParentImage|contains: - Google Chrome Helper - Google Chrome CommandLine|contains: - /Volumes/Google Chrome/Google Chrome.app/Contents/Frameworks/*/Resources/install.sh - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/*/Resources/keystone_promote_preflight.sh - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/*/Resources/keystone_promote_postflight.sh filter_main_ms_edge: ParentImage|contains: Microsoft Edge CommandLine|contains: - IOPlatformExpertDevice - hw.model filter_main_chromerecovery: ParentImage|contains: - Google Chrome Helper - Google Chrome CommandLine|contains|all: - /Users/ - /Library/Application Support/Google/Chrome/recovery/ - /ChromeRecovery filter_optional_null: CommandLine: null filter_optional_empty: CommandLine: '' condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate browser install, update and recovery scripts level: medium