[rule]
description = """
Identifies the modification of a scheduled task registry key by an unusual process. This behavior is consistent with an
adversary attempting to persist or execute via scheduled tasks while avoiding generating event logs.
"""
id = "817af31e-a360-44eb-9019-e694395627d1"
license = "Elastic License v2"
name = "Suspicious Scheduled Task Registry Modification"
os_list = ["windows"]
reference = ["https://github.com/netero1010/GhostTask/"]
version = "1.0.7"
query = '''
registry where event.action == "modification" and registry.data.strings != "null" and process.executable != null and
process.thread.Ext.call_stack_summary : "?*" and
registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\*Actions*" and
not (process.executable : ("?:\\Windows\\system32\\svchost.exe", "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe") and
process.thread.Ext.call_stack_summary : ("*schedsvc.dll*", "*Unknown*")) and
not process.executable : "C:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_*\\TiWorker.exe"
'''
min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.005"
name = "Scheduled Task"
reference = "https://attack.mitre.org/techniques/T1053/005/"
[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "8.7.0"