Query: alert when Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svc
Matching passage: Sigma rule: Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svc. Logsource: windows / registry_set. Rule: title: Scheduled TaskCache Change by Uncommon Program id: 4720b7df-40c3-48fd-bbdf-fd4b3c464f0d status: test description: Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious references: - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ - https://labs.f-secure.com/blog/scheduled-task-tampering/ author: Syed Hasan (@syedhasan009) date: 2021-06-18 modified: 2025-10-22 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053 - attack.t1053.005 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\ filter_main_empty: Details: (Empty) filter_main_null: Details: null filter_main_other: TargetObject|contains: - Microsoft\Windows\UpdateOrchestrator - Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask\Index - Microsoft\Windows\Flighting\OneSettings\RefreshCache\Index filter_main_mousocoreworker: Image|endswith: C:\Windows\System32\MoUsoCoreWorker.exe filter_main_services: Image|endswith: C:\Windows\System32\services.exe filter_main_tiworker: Image|startswith: C:\Windows\ Image|endswith: \TiWorker.exe filter_main_svchost: Image: C:\WINDOWS\system32\svchost.exe filter_main_ngen: Image|startswith: C:\Windows\Microsoft.NET\Framework Image|endswith: \ngen.exe TargetObject|contains: - \Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B66B135D-DA06-4FC4-95F8-7458E1D10129} - \Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\.NET Framework\.NET Framework NGEN filter_main_office: Image: - C:\Program Files\Microsoft Office\root\Integration\Integrator.exe - C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe - C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe - C:\Program Files (x86)\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe filter_main_msiexec: Image: C:\Windows\System32\msiexec.exe filter_main_explorer: Image: C:\Windows\explorer.exe TargetObject|contains: \Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\PLA\Server Manager Performance Monitor\ filter_main_system: Image: System filter_main_runtimebroker: Image: C:\Windows\System32\RuntimeBroker.exe filter_optional_dropbox_updater: Image: - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe - C:\Program Files\Dropbox\Update
Near-miss passage: Sigma rule: Detects Windows services that got terminated for whatever reason. Logsource: windows / system. Rule: title: Windows Service Terminated With Error id: acfa2210-0d71-4eeb-b477-afab494d596c related: - id: d6b5520d-3934-48b4-928c-2aa3f92d6963 type: similar status: test description: Detects Windows services that got terminated for whatever reason references: - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-14 tags: - attack.stealth logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7023 condition: selection falsepositives: - False positives could occur since service termination could happen due to multiple reasons level: low