Threat Hunting for Suspicious Schedule Task

Project Name: Threat Hunting for Suspicious Schedule Task

Description: Attacker uses scheduled tasks to deliver their payload on OS level.

This article will help you to understand how attackers use scheduled tasks primarily for 3 reasons.
1. To keep persistence, lateral movement, execution, detection evasion, and privilege escalation in organization.
2. Execution of payload
3. Interval / Pattern based East <–> West & North <–> South Connection establishment.

Author: Rohit D Sadgune

FAQ:

How to perform threat hunting for Suspicious Scheduled task?
Co-relation of task creation to process anomaly.
Co-relation of schedule task to network anomaly.

Threat Hunting for Suspicious Schedule Task.

1. Unusual process execution followed by suspicious task creation. (Within a time interval of 1 min)

A new process has been created (EventID = 4688)
- Process Command Line Contains “Get-ScheduledTask”
- New Process Name Contains “schtasks.exe | cmd.exe | powershell.exe | regsvr32.exe | rundll32.exe | mshta.exe”
- Creator Process Name Contains “schtasks.exe | cmd.exe | powershell.exe | regsvr32.exe | rundll32.exe | mshta.exe”
Rare task creation by same account.

2. Schedule tasks created and deleted in a very short period.
A. In 4698 and 4699 “Task Name ” & “Account Domain” should be the same.
B. “Account Name” Can be the same or different.

3. Unusual task creation and “Triggers” rarely.

4. Schedule Task creation (4698) followed by either of EventID within 1 min.
A scheduled task was updated (4702) Task Name :- contains — > powershell.exe, wsscript.exe, rundll32.exe, mashta.exe, arp.exe, at.exe, bitsadmin.exe, certutil.exe, cmd.exe, dsget.exe, dsquery.exe, find.exe, findstr.exe, fsutil.exe, hostname.exe, ipconfig.exe, nbstat.exe, net.exe, net1.exe, netdom.exe, netsh.exe, netstat.exe, nltest.exe, nslookup.exe, ntdsutil.exe, pathping.exe, ping.exe, qprocess.exe, query.exe, qwinsta.exe, reg.exe, rundll32.exe, sc.exe, schtasks.exe, systeminfo.exe, tasklist.exe, tracert.exe, ver.exe, vssadmin.exe, wevtutil.exe, whoami.exe, wmic.exe, wusa.exe, Gsecdump, Procdump, comsvcs.dll, MiniDump, Dumpert, vssadmin, dcsync, Unshadow, smb_enum_gpp, Gpp-Decrypt, ProLock, ZeroCleare, Beapy, Nishang, PWDump, acehash, SQLPS.EXE, out-minidump, powermemory, secretsdump

A new process has been created (EventID = 4688) New Process Name :- contains ( Suspicious Process Names) powershell.exe, wsscript.exe, rundll32.exe, mashta.exe, arp.exe, at.exe, bitsadmin.exe, certutil.exe, cmd.exe, dsget.exe, dsquery.exe, find.exe, findstr.exe, fsutil.exe, hostname.exe, ipconfig.exe, nbstat.exe, net.exe, net1.exe, netdom.exe, netsh.exe, netstat.exe, nltest.exe, nslookup.exe, ntdsutil.exe, pathping.exe, ping.exe, qprocess.exe, query.exe, qwinsta.exe, reg.exe, rundll32.exe, sc.exe, schtasks.exe, systeminfo.exe, tasklist.exe, tracert.exe, ver.exe, vssadmin.exe, wevtutil.exe, whoami.exe, wmic.exe, wusa.exe, Gsecdump, Procdump, comsvcs.dll, MiniDump, Dumpert, vssadmin, dcsync, Unshadow, smb_enum_gpp, Gpp-Decrypt, ProLock, ZeroCleare, Beapy, Nishang, PWDump, acehash, SQLPS.EXE, out-minidump, powermemory, secretsdump

Process Command Line :- Contains (Command and Control Tools) — >BindShellBypassHostFirewallwithSMB, ChaShell, CobaltStrike, Covenant, DDoor, Diagon, DnsCat2, DnsShell, DockerDBC2, DockerDNSCat, DOHC2, dropboxC2_DBC2, External_c2_framework, FudgeC2, GCat, Gorsh, HRShell_httpShell, ICMPSH, ICMPTunnel, ICMP_Tunnel_Python, Invoke-PipeShell, MacSwiftShell, Merlin, Nuages, OneLogicalMyth_Shell, Ping-Pwn, PoshC2, PowerCat, PowerHub, PowershellExample, Prismatica, Pupy, RedPeanut, ReUseExistingConnectionOneWayStager, ReverseShellGen, ReverseTCPEncrptedPowershell, RSH, SharpSocks, SilentTrinity, Slackor, Throwback, ThunderShell, TinkerShell, Tiny-SHell, TrevorC2, Tunna, Udp2Raw, UndetectableCSharpShell, Websocket-Smuggle, WebSocketC2, WheresMyImplant, WinSpy

Process Command Line :- Contains (Backdoor Process) — >Simple Shell, B374K Shell, C99 Shell, R57 Shell, Wso Shell, 0byt3m1n1, Alfa Shell, Indoxploit Shell, Marion001 Shell, Mini Shell, p0wny-shell, Sadrazam Shell, Webadmin Shell, WordPress Shell, LazyShell, Pouya Shell, Kacak Asp Shell, BetterBackdoor, Pupy, Thefatrat, Evilosx, Phpsploit, Dr0p1t, Asyncrat C Sharp, Diamorphine, Powershell Rat, Diffie Hellman, Vegile, Aviator, Chromebackdoor, Cloak, Gdog, Paradoxiarat, Xeexe Topantivirusevasion, Kithack, S6_pcie_microblaze, Tomcatwardeployer, Remot3d, Rspet, Nativepayload_dns, Openssh Backdoor Kit, Canisrufus, Betterbackdoor, Pwnginx, Pyiris, Hg8045q

B. Unusual traffic to suspicious port.
Destination Port=2222 | Destination Port=4444 | Destination Port=5555 | Destination Port=7777

8. Hunting Registry changes: When creating Scheduled Tasks, there are multiple registry path that can be monitored.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCach
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree

9. Hunting For Schedule Task Commands

A. Schtasks /Create

B. Local task creation.
— > schtasks /Create /SC minute /MO 5 /TN “RDS_shell” /TR c:\Threat_Hunting\RDS_shell\RDS_shell.exe

C. Remote Task Creation
— > schtasks /Create /S Hunt777.hackforlab.com /RU RDS /RP RDS@RDS6781 /TN “Threat_Hunting_RDS” /TR c:\Threat_Hunting\RDS_shell\Threat_Hunting_RDS.exe /SC daily

D. Conti Ransomware task creation. :- Windows Defender scans and updates disabled.
— > SCHTASKS /s Hunt777.hackforlab.com /RU “hackforlab” /create /tn Conti_Ransomware_task /tr “powershell.exe Set-MpPreference-DisableRealtimeMonitoring $true” /sc ONCE /sd 01/01/2022 /st 01:01

E. Execution
–> schtasks /create /ru “RDS” /tn “update” /tr “cmd /c c:\windows\temp\update.bat” /sc once /f /st 05:39:00

10. Suspicious task creation or update followed by successful network traffic (Within 1 min)

A. EventID = 4698 OR EventID = 4702 unusual “Task Name”
B. Followed by suspicious network traffic to Destination Port=445 | Destination Port=389 | Destination Port=636
To identify suspicious traffic (Traffic allowed or Denied does not matter.)
              B1. Communication to a rare destination address.
              B2. Volumetric increase in connection to the same destination address.
              B3. Catalogue behavior detection over destination address. (Distinct Destination Address)

11. Remote Task Hunting.

A. Windows EventID “A network share object was checked to see whether client can be granted desired access” 5145
Share Name contains *\IPC$ & Relative Target Name Contains “ATSVC” :- ATSVC is Microsoft AT-Scheduler Service primarily used for DEC/RPC protocol.

B. 4624 Followed by Schedule task creation (4698). Within 1 min successful authentication using the same Logon ID.

Forensics and Cyber Threat Research Area

Threat Hunting for Suspicious Schedule Task.

Like this:

Related

Leave a Reply Cancel reply

Indicator of Attacks | Indicator of Compromise

Recent Posts

Hackforlab Category

FaceBook Page

SIEM | UEBA

GridView List Posts Widget

Network Threat Hunting with Outbound Traffic

Threat Hunting for Suspicious Schedule Task

Threat Hunting with Authentication Events

Network Threat Hunting Using Bmon

Threat Hunting with Tshark

Cyber Threat Attacks / Hunting

Cyber Deception

FOLLOW US

CYBER THREAT CATEGORIES

Top Cyber Security Articles

Threat Hunting Scenarios

Forensics and Cyber Threat Research Area

Threat Hunting for Suspicious Schedule Task.

SHARE

Like this:

Related

Related Articles

Leave a Reply Cancel reply

Indicator of Attacks | Indicator of Compromise

Recent Posts

Hackforlab Category

SOCIAL HACKFORLAB

FaceBook Page

SIEM | UEBA

GridView List Posts Widget

Network Threat Hunting with Outbound Traffic

Threat Hunting for Suspicious Schedule Task

Threat Hunting with Authentication Events

Network Threat Hunting Using Bmon

Threat Hunting with Tshark

Cyber Threat Attacks / Hunting

Cyber Deception