LoFP LoFP / this analytic may also capture legitimate administrative activities such as system updates or maintenance tasks, which can be classified as false positives. filter as needed.

Techniques

Sample rules

Schtasks used for forcing a reboot

Description

The following analytic utilizes a Splunk query to pinpoint potential threats by monitoring the ‘schtasks.exe’ command-line usage. This particular command, especially when used in tandem with ‘shutdown’ and ‘/create’ flags, can suggest an adversarial force intending to schedule unwarranted system reboots. The query focuses on endpoint process data and retrieves details such as the process name, the parent process name, the destination, and the user involved. Essential to the investigation are the earliest and latest timestamps of these events, providing an activity timeline. Data such as the targeted host and initiating user offer valuable context for analyst.

Detection logic


| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe Processes.process="*shutdown*" Processes.process="*/create *" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `schtasks_used_for_forcing_a_reboot_filter`