Detection rules › Sigma
Persistence and Execution at Scale via GPO Scheduled Task
Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1053.005 Scheduled Task/Job: Scheduled Task |
| Persistence | T1053.005 Scheduled Task/Job: Scheduled Task |
| Privilege Escalation | T1053.005 Scheduled Task/Job: Scheduled Task |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Security-Auditing | 5136 | A directory service object was modified. |
| Security-Auditing | 5145 | A network share object was checked to see whether client can be granted desired access. |
Stages and Predicates
Stage 1: 1 of selection_5136
AttributeLDAPDisplayName: [gPCMachineExtensionNames, gPCUserExtensionNames]
or:
AttributeValue|contains: 'AADCED64-746C-4633-A97C-D61349046527'
AttributeValue|contains: 'CAB54552-DEEA-4691-817E-ED4A4D1AFC72'
Stage 2: 1 of selection_5145
or:
AccessList|contains: '%%4417'
AccessList|contains: WriteData
RelativeTargetName|endswith: ScheduledTasks.xml
ShareName|endswith: '\SYSVOL'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
AccessList | match |
|
AttributeLDAPDisplayName | eq |
|
AttributeValue | match |
|
RelativeTargetName | ends_with |
|
ShareName | ends_with |
|
Neighbors
Broader alternatives (more inclusive than this rule)
These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.
- Startup/Logon Script Added to Group Policy Object (drops 2 filters this rule applies)
Often fire together
Rules that target events appearing in the same incident timelines. They pattern-match on adjacent steps of the same TTP, so an alert from one is often paired with alerts from these. Useful for triage context and for assembling chained-detection rules.
- Potential Kerberos Coercion via DNS-Based SPN Spoofing
- Suspicious Remote Registry Access via SeBackupPrivilege
- Startup/Logon Script added to Group Policy Object
- Scheduled Task Execution at Scale via GPO
- Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation
- Startup/Logon Script Added to Group Policy Object
- Windows AD Short Lived Server Object
- Windows Administrative Shares Accessed On Multiple Hosts
Share event IDs (chain-detection candidates)
Rules that observe the same Windows event-ID pairs as this one. If you're authoring a multi-stage / sequence rule that spans these events, these are the existing detections that already cover one or both endpoints.