IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Remote Scheduled Task Creation
editRemote Scheduled Task Creation
editIdentifies remote scheduled task creations on a target host. This could be indicative of adversary lateral movement.
Rule type: eql
Rule indices:
- logs-endpoint.events.*
- winlogbeat-*
- logs-windows.*
Severity: medium
Risk score: 47
Runs every: 5 minutes
Searches indices from: now-9m (Date Math format, see also Additional look-back time
)
Maximum alerts per execution: 100
Tags:
- Elastic
- Host
- Windows
- Threat Detection
- Lateral Movement
Version: 3 (version history)
Added (Elastic Stack release): 7.11.0
Last modified (Elastic Stack release): 7.13.0
Rule authors: Elastic
Rule license: Elastic License v2
Investigation guide
editTriage and analysis
Decode the base64 encoded tasks actions registry value to investigate the task configured action.
Rule query
edit/* Task Scheduler service incoming connection followed by TaskCache registry modification */ sequence by host.id, process.entity_id with maxspan = 1m [network where process.name : "svchost.exe" and network.direction == "incoming" and source.port >= 49152 and destination.port >= 49152 and source.address != "127.0.0.1" and source.address != "::1" ] [registry where registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\*\\Actions"]
Threat mapping
editFramework: MITRE ATT&CKTM
-
Tactic:
- Name: Lateral Movement
- ID: TA0008
- Reference URL: https://attack.mitre.org/tactics/TA0008/
-
Technique:
- Name: Remote Services
- ID: T1021
- Reference URL: https://attack.mitre.org/techniques/T1021/
-
Tactic:
- Name: Execution
- ID: TA0002
- Reference URL: https://attack.mitre.org/tactics/TA0002/
-
Technique:
- Name: Scheduled Task/Job
- ID: T1053
- Reference URL: https://attack.mitre.org/techniques/T1053/
Rule version history
edit- Version 3 (7.13.0 release)
-
- Formatting only
- Version 2 (7.12.0 release)
-
- Formatting only