Query: detection rule: Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any too
Matching passage: Sigma rule: Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any too. Logsource: windows / registry_set. Rule: title: Hide Schedule Task Via Index Value Tamper id: 5b16df71-8615-4f7f-ac9b-6c43c0509e61 related: - id: acd74772-5f88-45c7-956b-6a7b36c294d2 type: similar - id: 526cc8bc-1cdc-48ad-8b26-f19bff969cec type: similar status: test description: 'Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique) ' references: - https://blog.qualys.com/vulnerabilities-threat-research/2022/06/20/defending-against-scheduled-task-attacks-in-windows-environments author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-26 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|contains|all: - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ - Index Details: DWORD (0x00000000) condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker. Logsource: windows / process_creation. Rule: title: PUA - Process Hacker Execution id: 811e0002-b13b-4a15-9d00-a613fce66e42 related: - id: 5722dff1-4bdd-4949-86ab-fbaf707e767a type: similar status: test description: 'Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors abused older vulnerable versions to manipulate system processes. ' references: - https://processhacker.sourceforge.io/ - https://www.crowdstrike.com/blog/falcon-overwatch-report-finds-increase-in-ecrime/ author: Florian Roth (Nextron Systems) date: 2022-10-10 modified: 2024-11-23 tags: - attack.discovery - attack.persistence - attack.privilege-escalation - attack.stealth - attack.t1622 - attack.t1564 - attack.t1543 logsource: category: process_creation product: windows detection: selection: - Image|contains: \ProcessHacker_ - Image|endswith: \ProcessHacker.exe - OriginalFileName: - ProcessHacker.exe - Process Hacker - Description: Process Hacker - Product: Process Hacker - Hashes|contains: - MD5=68F9B52895F4D34E74112F3129B3B00D - MD5=B365AF317AE730A67C936F21432B9C71 - SHA1=A0BDFAC3CE1880B32FF9B696458327CE352E3B1D - SHA1=C5E2018BF7C0F314FED4FD7FE7E69FA2E648359E - SHA256=D4A0FE56316A2C45B9BA9AC1005363309A3EDC7ACF9E4DF64D326A0FF273E80F - SHA256=BD2C2CF0631D881ED382817AFCCE2B093F4E412FFB170A719E2762F250ABFEA4 - IMPHASH=3695333C60DEDECDCAFF1590409AA462 - IMPHASH=04DE0AD9C37EB7BD52043D2ECAC958DF condition: selection falsepositives: - While sometimes 'Process Hacker is used by legitimate administrators, the execution of Process Hacker must be investigated and allowed on a case by case basis level: medium