LoFP LoFP / legitimate scheduled jobs may be created during installation of new software.

Techniques

Sample rules

Persistence via Scheduled Job Creation

Description

A job can be used to schedule programs or scripts to be executed at a specified date and time. Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.

Detection logic

file where host.os.type == "windows" and event.type != "deletion" and
  file.path : "?:\\Windows\\Tasks\\*" and file.extension : "job" and
  not (
    (
      process.executable : "?:\\Program Files\\CCleaner\\CCleaner64.exe" and
      file.path : "?:\\Windows\\Tasks\\CCleanerCrashReporting.job"
    ) or
    process.executable : (
      "?:\\Program Files (x86)\\DesktopCentral_Agent\\bin\\dcagentregister.exe",
      "?:\\Program Files (x86)\\epson\\Epson Scan 2\\Update\\e_dtsksd.exe",
      "?:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\bin\\dcagentregister.exe",
      "?:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\dcconfig.exe",
      "?:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\UemsComponentUpgrader.exe",
      "?:\\Program Files (x86)\\Skillbrains\\Updater\\*\\Updater.exe",
      "?:\\Windows\\System32\\drivers\\RivetNetworks\\Killer\\CustomizeInstallFirstRun.exe"
    )
  )