curben
/
blog
mirror of https://gitlab.com/curben/blog
1
0
Fork 0
Code Issues Releases Wiki Activity

refactor(unusual-schtasks): combine alerts

This commit is contained in:
Ming Di Leom 2025-08-03 07:59:32 +00:00
parent 7900d8410b
commit 3511c59121
No known key found for this signature in database
GPG Key ID: 32D3E28E96A695E8
3 changed files with 4 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
source/threat-hunting/index.md
View File

@ -2,7 +2,7 @@
title: Splunk Threat Hunting title: Splunk Threat Hunting
layout: page layout: page
date: 2025-01-15 date: 2025-01-15
updated: 2025-07-27 updated: 2025-08-03
--- ---
- [Generate ad_users.csv](ldap-ad-users) - [Generate ad_users.csv](ldap-ad-users)
@ -124,6 +124,5 @@ updated: 2025-07-27
- [Windows Firewall Modification](windows-firewall-modification) - [Windows Firewall Modification](windows-firewall-modification)
- [Windows JScript execution](windows-jscript-execution) - [Windows JScript execution](windows-jscript-execution)
- [Windows Sandbox execution](windows-sandbox-execution) - [Windows Sandbox execution](windows-sandbox-execution)
- [Windows Script Executed from Scheduled Task](windows-script-executed-from-scheduled-task)
- [Windows Script Executed from ZIP](windows-script-executed-from-zip) - [Windows Script Executed from ZIP](windows-script-executed-from-zip)
- [WinRAR Spawning Shell Application](winrar-spawning-shell-application) - [WinRAR Spawning Shell Application](winrar-spawning-shell-application)

6
source/threat-hunting/unusual-scheduled-task.md
View File

@ -2,14 +2,14 @@
title: Unusual Scheduled Task title: Unusual Scheduled Task
layout: page layout: page
date: 2025-07-27 date: 2025-07-27
updated: 2025-08-03
--- ---
Description: A new scheduled task is created with minutely interval or with highest run level. Description: [Minutely interval or with highest run level](https://blog.talosintelligence.com/gophish-powerrat-dcrat/#threat-actor-delivers-dcrat), [wscript/cscript](https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2024/)
References: [1](https://blog.talosintelligence.com/gophish-powerrat-dcrat/#threat-actor-delivers-dcrat)
SPL: SPL:
```spl ```spl
| tstats summariesonly=true allow_old_summaries=true count FROM datamodel=Endpoint.Processes WHERE index="windows" Processes.process_name="schtasks.exe" Processes.process IN ("*minute*", "*highest*") BY index, host, Processes.signature_id, Processes.signature, Processes.parent_process, Processes.process, Processes.user, _time span=1s | tstats summariesonly=true allow_old_summaries=true count FROM datamodel=Endpoint.Processes WHERE index="windows" Processes.process_name="schtasks.exe" (Processes.process IN ("*minute*", "*highest*") OR (Processes.process="*create*" Processes.process IN ("*wscript*", "*cscript*"))) BY index, host, Processes.signature_id, Processes.signature, Processes.parent_process, Processes.process, Processes.user, _time span=1s
| rename Processes.* AS *, signature_id AS EventCode, signature AS EventDescription | rename Processes.* AS *, signature_id AS EventCode, signature AS EventDescription
| eval Time = strftime(_time, "%Y-%m-%d %H:%M:%S %z") | eval Time = strftime(_time, "%Y-%m-%d %H:%M:%S %z")
| lookup ad_users sAMAccountName AS user OUTPUT displayName AS Name, mail AS Email | lookup ad_users sAMAccountName AS user OUTPUT displayName AS Name, mail AS Email

16
source/threat-hunting/windows-script-executed-from-scheduled-task.md
View File

@ -1,16 +0,0 @@
---
title: Windows Script Executed from Scheduled Task
layout: page
date: 2025-07-27
---
References: [1](https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2024/)
SPL:
```spl
| tstats summariesonly=true allow_old_summaries=true count FROM datamodel=Endpoint.Processes WHERE index="windows" Processes.process_name="schtasks.exe" Processes.process="*create*" Processes.process IN ("*wscript*", "*cscript*") BY index, host, Processes.signature_id, Processes.signature, Processes.parent_process, Processes.process, Processes.user, _time span=1s
| rename Processes.* AS *, signature_id AS EventCode, signature AS EventDescription
| eval Time = strftime(_time, "%Y-%m-%d %H:%M:%S %z")
| lookup ad_users sAMAccountName AS user OUTPUT displayName AS Name, mail AS Email
| table Time, index, host, EventCode, EventDescription, parent_process, process, user, Name, Email
```