Detection rules › Equivalence class
eq_0003 — 2 rules with the same canonical form
Members
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1053.005 Scheduled Task/Job: Scheduled Task |
| Persistence | T1053.005 Scheduled Task/Job: Scheduled Task |
| Privilege Escalation | T1053.005 Scheduled Task/Job: Scheduled Task |
Stages and predicates (per member)
Each member's stage rendered in its own native syntax (verbatim source where the IR captures it; falls back to the synthesised native form for the few stage types whose source segments aren't recoverable).
Suspicious Schtasks Schedule Types — stage 1 all of selection_img
or:
Image|endswith: '\schtasks.exe'
OriginalFileName: schtasks.exe
Suspicious Schtasks Schedule Types — stage 2 all of selection_time
or:
CommandLine|contains: ' ONCE '
CommandLine|contains: ' ONIDLE '
CommandLine|contains: ' ONLOGON '
CommandLine|contains: ' ONSTART '
Suspicious Schtasks Schedule Types — stage 3 not 1 of filter_privs
or:
CommandLine|contains: ' SYSTEM'
CommandLine|contains: HIGHEST
CommandLine|contains: 'NT AUT'
Suspicious Schtasks Schedule Type With High Privileges — stage 4 all of selection_img
or:
Image|endswith: '\schtasks.exe'
OriginalFileName: schtasks.exe
Suspicious Schtasks Schedule Type With High Privileges — stage 5 all of selection_time
or:
CommandLine|contains: ' ONCE '
CommandLine|contains: ' ONIDLE '
CommandLine|contains: ' ONLOGON '
CommandLine|contains: ' ONSTART '
Suspicious Schtasks Schedule Type With High Privileges — stage 6 all of selection_privs
or:
CommandLine|contains: ' SYSTEM'
CommandLine|contains: HIGHEST
CommandLine|contains: 'NT AUT'
Indicators (across all members)
| Field | Kind | Value | Members | Corpus |
|---|---|---|---|---|
CommandLine | match | ONCE | 2 | 2 |
CommandLine | match | ONIDLE | 2 | 2 |
CommandLine | match | ONLOGON | 2 | 2 |
CommandLine | match | ONSTART | 2 | 2 |
CommandLine | match | SYSTEM | 2 | 2 |
CommandLine | match | HIGHEST | 2 | 2 |
CommandLine | match | NT AUT | 2 | 4 |
Image | ends_with | \schtasks.exe | 2 | 45 |
OriginalFileName | eq | schtasks.exe | 2 | 14 |