Query: detect Detects the creation of a schtask via PowerSploit or Empire Default Configuration. in logs
Matching passage: Sigma rule: Detects the creation of a schtask via PowerSploit or Empire Default Configuration.. Logsource: windows / process_creation. Rule: title: HackTool - Default PowerSploit/Empire Scheduled Task Creation id: 56c217c3-2de2-479b-990f-5c109ba8458f status: test description: Detects the creation of a schtask via PowerSploit or Empire Default Configuration. references: - https://github.com/0xdeadbeefJERKY/PowerSploit/blob/8690399ef70d2cad10213575ac67e8fa90ddf7c3/Persistence/Persistence.psm1 - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/powershell/persistence/userland/schtasks.py author: Markus Neis, @Karneades date: 2018-03-06 modified: 2023-03-03 tags: - attack.execution - attack.persistence - attack.privilege-escalation - attack.s0111 - attack.g0022 - attack.g0060 - car.2013-08-001 - attack.t1053.005 - attack.t1059.001 logsource: product: windows category: process_creation detection: selection: ParentImage|endswith: - \powershell.exe - \pwsh.exe Image|endswith: \schtasks.exe CommandLine|contains|all: - /Create - powershell.exe -NonI - /TN Updater /TR CommandLine|contains: - /SC ONLOGON - /SC DAILY /ST - /SC ONIDLE - /SC HOURLY condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2. Logsource: windows / network_connection. Rule: title: Suspicious Non-Browser Network Communication With Telegram API id: c3dbbc9f-ef1d-470a-a90a-d343448d5875 status: test description: Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2 references: - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/small-sieve/NCSC-MAR-Small-Sieve.pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-19 tags: - attack.command-and-control - attack.exfiltration - attack.t1102 - attack.t1567 - attack.t1105 logsource: product: windows category: network_connection detection: selection: DestinationHostname|contains: api.telegram.org filter_main_brave: Image|endswith: \brave.exe filter_main_chrome: Image: - C:\Program Files\Google\Chrome\Application\chrome.exe - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe filter_main_firefox: Image: - C:\Program Files\Mozilla Firefox\firefox.exe - C:\Program Files (x86)\Mozilla Firefox\firefox.exe filter_main_ie: Image: - C:\Program Files (x86)\Internet Explorer\iexplore.exe - C:\Program Files\Internet Explorer\iexplore.exe filter_main_maxthon: Image|endswith: \maxthon.exe filter_main_edge_1: - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\ - Image|endswith: \WindowsApps\MicrosoftEdge.exe - Image: - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - C:\Program Files\Microsoft\Edge\Application\msedge.exe filter_main_edge_2: Image|startswith: - C:\Program Files (x86)\Microsoft\EdgeCore\ - C:\Program Files\Microsoft\EdgeCore\ Image|endswith: - \msedge.exe - \msedgewebview2.exe filter_main_opera: Image|endswith: \opera.exe filter_main_safari: Image|endswith: \safari.exe filter_main_seamonkey: Image|endswith: \seamonkey.exe filter_main_vivaldi: Image|endswith: \vivaldi.exe filter_main_whale: Image|endswith: \whale.exe condition: selection and not 1 of filter_main_* falsepositives: - Legitimate applications communicating with the Telegram API e.g. web browsers not in the exclusion list, app with an RSS etc. level: medium