Potential SSH Tunnel Persistence Install Using A Scheduled Task

Severity: high
Author: Rory Duncan
Source: upstream

Detects the creation of new scheduled tasks via commandline, using Schtasks.exe. This rule detects tasks creating that call OpenSSH, which may indicate the creation of reverse SSH tunnel to the attacker's server.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1053.005` Scheduled Task/Job: Scheduled Task
Persistence	`T1053.005` Scheduled Task/Job: Scheduled Task
Privilege Escalation	`T1053.005` Scheduled Task/Job: Scheduled Task

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `selection_img`

or:
Image|endswith: '\schtasks.exe'
OriginalFileName: schtasks.exe

Stage 2: `1 of selection_cli_sshd`

CommandLine|contains: ' /create '
CommandLine|contains: -f
CommandLine|contains: sshd.exe

Stage 3: `1 of selection_cli_ssh`

CommandLine|contains: ' /create '
CommandLine|contains: -i
CommandLine|contains: ssh.exe

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`/create` corpus 14 (sigma 14) `-f` corpus 5 (sigma 5) `-i` corpus 6 (sigma 6) `ssh.exe` `sshd.exe`
`Image`	ends_with	`\schtasks.exe` corpus 45 (sigma 45)
`OriginalFileName`	eq	`schtasks.exe` corpus 14 (sigma 14)