LoFP / in some cases, an automated script or system may enable this setting continuously, leading to false positives. to avoid such situations, it is recommended to monitor the frequency and context of the registry modification and modify or filter the detection rules as needed. this can help to reduce the number of false positives and ensure that only genuine threats are identified. additionally, it is important to investigate any detected instances of this modification and analyze them in the broader context of the system and network to determine if further action is necessary.

Techniques

• T1053.005

Sample rules

Windows Enable Win32 ScheduledJob via Registry

• source: splunk
• technicques:
  • T1053.005

Description

This analytic searches for a registry modification that enables the use of the at.exe or wmi Win32_ScheduledJob command to add scheduled tasks on a Windows endpoint. Specifically, it looks for the creation of a new DWORD value named “EnableAt” in the following registry path: “HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration”. If this value is set to 1, it enables the at.exe and wmi Win32_ScheduledJob commands to schedule tasks on the system. Detecting this registry modification is important because it may indicate that an attacker has enabled the ability to add scheduled tasks to the system, which can be used to execute malicious code at specific times or intervals.

Detection logic

| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\CurrentVersion\\Schedule\\Configuration*" Registry.registry_value_name=EnableAt  by Registry.dest, Registry.user, Registry.registry_value_name, Registry.registry_value_type 
| `security_content_ctime(lastTime)` 
| `security_content_ctime(firstTime)` 
| `drop_dm_object_name(Registry)` 
| `windows_enable_win32_scheduledjob_via_registry_filter`