Elastic Defend high stable eql

Suspicious Scheduled Task Creation via Masqueraded XML File

Identifies the creation of a scheduled task using an XML file that does not have a .xml file extension. This behavior is consistent with an adversary attempting to establish persistence in a stealthy manner to evade detection.

View Source

Detection Logic

process where event.action == "start" and
  process.pe.original_file_name : "schtasks.exe" and
  process.args : ("/create", "-create") and
  process.args : ("/xml", "-xml") and
  not process.command_line : "*.xml*" and
  not process.Ext.token.integrity_level_name == "system" and
  not process.parent.executable : 
             ("?:\\ProgramData\\OEM\\UpgradeTool\\CareCenter_*\\BUnzip\\Setup_msi.exe", 
              "?:\\Program Files\\Axis Communications\\AXIS Camera Station\\SetupActions.exe",
              "?:\\Program Files\\Axis Communications\\AXIS Device Manager\\AdmSetupActions.exe",
              "?:\\Program Files (x86)\\Zemana\\AntiMalware\\AntiMalware.exe",
              "?:\\Program Files\\Dell\\SupportAssist\\pcdrcui.exe",
              "?:\\Program Files\\Axis Communications\\AXIS Camera Station\\Installer*\\SetupActions.exe",
              "?:\\Program Files (x86)\\Axis Communications\\AXIS Camera Station\\Installer*\\SetupActions.exe", 
              "?:\\Program Files\\WinCompose\\wincompose.exe") and
  not (process.parent.name : "rundll32.exe" and process.parent.args : "?:\\WINDOWS\\Installer\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc")

Field Validations

Loading…

Comments (0)

Loading comments...