detection.wiki

Detection rules › Splunk

WinEvent Scheduled Task Created to Spawn Shell

Author
Michael Haag, Splunk
Source
upstream

The following analytic detects the creation of scheduled tasks designed to execute commands using native Windows shells like PowerShell, Cmd, Wscript, or Cscript. It leverages Windows Security EventCode 4698 to identify when such tasks are registered. This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1053.005 Scheduled Task/Job: Scheduled Task
PersistenceT1053.005 Scheduled Task/Job: Scheduled Task
Privilege EscalationT1053.005 Scheduled Task/Job: Scheduled Task

Event coverage

ProviderEvent IDTitle
Security-Auditing4698A scheduled task was created.

Stages and Predicates

Stage 1: search

search EventCode=4698 TaskContent IN ("*bash.exe*", "*cmd.exe*", "*cscript.exe*", "*ksh.exe*", "*powershell.exe*", "*pwsh.exe*", "*scrcons.exe*", "*sh.exe*", "*wscript.exe*", "*zsh.exe*")

Stage 2: stats

stats BY Computer, TaskName, TaskContent

Stage 3: rename

rename

Stage 4: search

search

Stage 5: search

search

Stage 6: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventCodeeq
  • 4698 corpus 8 (splunk 8)
TaskContentin
  • "*bash.exe*"
  • "*cmd.exe*"
  • "*cscript.exe*"
  • "*ksh.exe*"
  • "*powershell.exe*"
  • "*pwsh.exe*"
  • "*scrcons.exe*"
  • "*sh.exe*"
  • "*wscript.exe*"
  • "*zsh.exe*"

Neighbors

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.