Detection rules › Splunk

Windows Scheduled Task DLL Module Loaded

Author
Teoderick Contreras, Splunk
Source
upstream

The following analytic detects instances where the taskschd.dll is loaded by processes running in suspicious or writable directories. This activity is unusual, as legitimate processes that load taskschd.dll typically reside in protected system locations. Malware or threat actors may attempt to load this DLL from writable or non-standard directories to manipulate the Task Scheduler and execute malicious tasks. By identifying processes that load taskschd.dll in these unsafe locations, this detection helps security analysts flag potentially malicious activity and investigate further to prevent unauthorized system modifications.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1053 Scheduled Task/Job
PersistenceT1053 Scheduled Task/Job
Privilege EscalationT1053 Scheduled Task/Job

Event coverage

ProviderEvent IDTitle
Sysmon7Image loaded

Stages and Predicates

Stage 1: search

search EventCode=7 Image IN ("*Recycle.bin*", "*\\PerfLogs\\*", "*\\Users\\Administrator\\Music\\*", "*\\Users\\Default\\*", "*\\Windows\\Media\\*", "*\\Windows\\servicing\\*", "*\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\windows\\fonts\\*", "*\\windows\\temp\\*", "\\Windows\\repair\\*") ImageLoaded="*\\taskschd.dll"

Stage 2: fillnull

fillnull

Stage 3: stats

stats BY Image, ImageLoaded, dest, loaded_file, loaded_file_path, original_file_name, process_exec, process_guid, process_hash, process_id, process_name, process_path, service_dll_signature_exists, service_dll_signature_verified, signature, signature_id, user_id, vendor_product

Stage 4: search

search

Stage 5: search

search

Stage 6: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventCodeeq
  • 7 corpus 35 (splunk 35)
Imagein
  • "*Recycle.bin*"
  • "*\\PerfLogs\\*"
  • "*\\Users\\Administrator\\Music\\*"
  • "*\\Users\\Default\\*"
  • "*\\Windows\\Media\\*"
  • "*\\Windows\\servicing\\*"
  • "*\\temp\\*" corpus 2 (splunk 2)
  • "*\\users\\public\\*" corpus 2 (splunk 2)
  • "*\\windows\\debug\\*"
  • "*\\windows\\fonts\\*"
  • "*\\windows\\temp\\*"
  • "\\Windows\\repair\\*"
ImageLoadedeq
  • "*\\taskschd.dll" corpus 2 (splunk 2)

Neighbors

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.