Elastic medium stable eql

Scheduled Task Execution at Scale via GPO

Detects the modification of Group Policy Object attributes to execute a scheduled task in the objects controlled by the GPO.

View Source

Detection Logic

any where host.os.type == "windows" and event.code in ("5136", "5145") and
(
  (
    winlog.event_data.AttributeLDAPDisplayName : (
      "gPCMachineExtensionNames",
      "gPCUserExtensionNames"
    ) and
    winlog.event_data.AttributeValue : "*CAB54552-DEEA-4691-817E-ED4A4D1AFC72*" and
    winlog.event_data.AttributeValue : "*AADCED64-746C-4633-A97C-D61349046527*"
  ) or
  (
    winlog.event_data.ShareName : "\\\\*\\SYSVOL" and
    winlog.event_data.RelativeTargetName : "*ScheduledTasks.xml" and
    winlog.event_data.AccessList:"*%%4417*"
  )
)

Field Validations

Loading…

Comments (0)

Loading comments...