Randomly Generated Scheduled Task Name

Author: Mauricio Velazco, Splunk
Source: upstream

The following analytic detects the creation of a Scheduled Task with a high entropy, randomly generated name, leveraging Event ID 4698. It uses the ut_shannon function from the URL ToolBox Splunk application to measure the entropy of the Task Name. This activity is significant as adversaries often use randomly named Scheduled Tasks for lateral movement and remote code execution, employing tools like Impacket or CrackMapExec. If confirmed malicious, this could allow attackers to execute arbitrary code remotely, potentially leading to further compromise and persistence within the network.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1053.005` Scheduled Task/Job: Scheduled Task
Persistence	`T1053.005` Scheduled Task/Job: Scheduled Task
Privilege Escalation	`T1053.005` Scheduled Task/Job: Scheduled Task

Event coverage

Provider	Event ID	Title
Security-Auditing	4698	A scheduled task was created.

Stages and Predicates

Stage 1: `search`

search EventCode=4698

Stage 2: `xmlkv`

xmlkv

Stage 3: `lookup`

lookup <lookup> Task_Name, word

Stage 4: `where`

where ut_shannon>3

Stage 5: `table`

table Author, Command, Enabled, Hidden, Task_Name, _time, dest, ut_shannon

Stage 6: `search`

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`EventCode`	eq	`4698` corpus 8 (splunk 8)
`ut_shannon`	gt	`3` corpus 2 (splunk 2)

Neighbors

Stricter alternatives (narrower than this rule)

The rules below may be useful if you find the current rule is too noisy / lacks specificity.

Windows Hidden Schedule Task Settings [splunk] (adds 1 filter) (first-stage match only; downstream stages may differ)
Windows Scheduled Tasks for CompMgmtLauncher or Eventvwr [splunk] (adds 1 filter) (first-stage match only; downstream stages may differ)
WinEvent Scheduled Task Created to Spawn Shell [splunk] (adds 1 filter) (first-stage match only; downstream stages may differ)
WinEvent Scheduled Task Created Within Public Path [splunk] (adds 1 filter) (first-stage match only; downstream stages may differ)

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.

Suspicious Scheduled Task Creation [sigma] (cross-vendor) (drops 1 filter this rule applies) (first-stage match only; downstream stages may differ)