LoFP / in some cases, an automated script or system may enable this setting continuously, leading to false positives. to avoid such situations, it is recommended to monitor the frequency and context of the registry modification and modify or filter the detection rules as needed. this can help to reduce the number of false positives and ensure that only genuine threats are identified. additionally, it is important to investigate any detected instances of this modification and analyze them in the broader context of the system and network to determine if further action is necessary.

Techniques

• T1053.005

Sample rules

Windows Enable Win32 ScheduledJob via Registry

• source: splunk
• technicques:
  • T1053.005

Description

The following analytic detects the creation of a new DWORD value named “EnableAt” in the registry path “HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration”. This modification enables the use of the at.exe or wmi Win32_ScheduledJob commands to add scheduled tasks on a Windows endpoint. The detection leverages registry event data from the Endpoint datamodel. This activity is significant because it may indicate that an attacker is enabling the ability to schedule tasks, potentially to execute malicious code at specific times or intervals. If confirmed malicious, this could allow persistent code execution on the system.

Detection logic

| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\CurrentVersion\\Schedule\\Configuration*" Registry.registry_value_name=EnableAt  by Registry.dest, Registry.user, Registry.registry_value_name, Registry.registry_value_type 
| `security_content_ctime(lastTime)` 
| `security_content_ctime(firstTime)` 
| `drop_dm_object_name(Registry)` 
| `windows_enable_win32_scheduledjob_via_registry_filter`