Query: write Sigma for Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior c
Matching passage: Sigma rule: Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior c. Logsource: windows / process_creation. Rule: title: Suspicious Scheduled Task Creation via Masqueraded XML File id: dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c status: test description: Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence references: - https://learn.microsoft.com/en-us/windows/win32/taskschd/daily-trigger-example--xml- - https://github.com/elastic/protections-artifacts/blob/084067123d3328a823b1c3fdde305b694275c794/behavior/rules/persistence_suspicious_scheduled_task_creation_via_masqueraded_xml_file.toml author: Swachchhanda Shrawan Poudel, Elastic (idea) date: 2023-04-20 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.stealth - attack.t1036.005 - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_cli_create: CommandLine|contains: - /create - -create selection_cli_xml: CommandLine|contains: - /xml - -xml filter_main_extension_xml: CommandLine|contains: .xml filter_main_system_process: IntegrityLevel: - System - S-1-16-16384 filter_main_rundll32: ParentImage|endswith: \rundll32.exe ParentCommandLine|contains|all: - :\WINDOWS\Installer\MSI - .tmp,zzzzInvokeManagedCustomActionOutOfProc filter_optional_third_party: ParentImage|endswith: - :\ProgramData\OEM\UpgradeTool\CareCenter_*\BUnzip\Setup_msi.exe - :\Program Files\Axis Communications\AXIS Camera Station\SetupActions.exe - :\Program Files\Axis Communications\AXIS Device Manager\AdmSetupActions.exe - :\Program Files (x86)\Zemana\AntiMalware\AntiMalware.exe - :\Program Files\Dell\SupportAssist\pcdrcui.exe condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Blocked Image/Driver Load For Policy Violation id: e4be5675-4a53-426a-8c81-a8bb2387e947 status: test description: Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy. references: - https://twitter.com/wdormann/status/1590434950335320065 - https://github.com/MicrosoftDocs/windows-itpro-docs/blob/40fe118976734578f83e5e839b9c63ae7a4af82d/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md#windows-codeintegrity-operational-log - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-10 modified: 2023-06-07 tags: - attack.persistence - attack.privilege-escalation - attack.t1543 logsource: product: windows service: codeintegrity-operational detection: selection: EventID: 3077 condition: selection falsepositives: - Unknown level: high