Suspicious Schtasks Execution AppData Folder

Hunt Hypothesis

Detects the creation of a schtask that executes a file from C:\Users<USER>\AppData\Local

Detection Rule

Sigma (Original)

title: Suspicious Schtasks Execution AppData Folder
id: c5c00f49-b3f9-45a6-997e-cfdecc6e1967
status: test
description: 'Detects the creation of a schtask that executes a file from C:\Users\<USER>\AppData\Local'
references:
    - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2022-03-15
modified: 2022-07-28
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1053.005
    - attack.t1059.001
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains|all:
            - '/Create'
            - '/RU'
            - '/TR'
            - 'C:\Users\'
            - '\AppData\Local\'
        CommandLine|contains:
            - 'NT AUT' # This covers the usual NT AUTHORITY\SYSTEM
            - ' SYSTEM ' # SYSTEM is a valid value for schtasks hence it gets it's own value with space
    filter:
        # FP from test set in SIGMA
        ParentImage|contains|all:
            - '\AppData\Local\Temp\'
            - 'TeamViewer_.exe'
        Image|endswith: '\schtasks.exe'
        CommandLine|contains: '/TN TVInstallRestore'
    condition: selection and not filter
falsepositives:
    - Unknown
level: high

KQL (Azure Sentinel)

imProcessCreate
| where (TargetProcessName endswith "\\schtasks.exe" and (TargetProcessCommandLine contains "/Create" and TargetProcessCommandLine contains "/RU" and TargetProcessCommandLine contains "/TR" and TargetProcessCommandLine contains "C:\\Users\\" and TargetProcessCommandLine contains "\\AppData\\Local\\") and (TargetProcessCommandLine contains "NT AUT" or TargetProcessCommandLine contains " SYSTEM ")) and (not((((ParentProcessName contains "\\AppData\\Local\\Temp\\" and ParentProcessName contains "TeamViewer_.exe") or (ActingProcessName contains "\\AppData\\Local\\Temp\\" and ActingProcessName contains "TeamViewer_.exe")) and TargetProcessName endswith "\\schtasks.exe" and TargetProcessCommandLine contains "/TN TVInstallRestore")))

Required Data Sources

False Positive Guidance

• Unknown

MITRE ATT&CK Context

• Tactic: Privilege Escalation
• Tactic: Execution
• Tactic: Persistence
• Technique: T1053.005 — T1053.005
• Technique: T1059.001 — PowerShell

References

• https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
• SigmaHQ Rule