Windows: Detect scheduled task and autoit3.exe activity consistent with OilRig malware tooling

title: "Windows: Detect scheduled task and autoit3.exe activity consistent with OilRig malware tooling"
id: 5d6da43e-f6cb-437e-9fca-bfb18c9e5aec
related:
  - id: 53ba33fd-3a50-4468-a5ef-c583635cfa92
    type: similar
  - id: c0580559-a6bd-4ef6-b9b7-83703d98b561
    type: similar
  - id: 7bdf2a7c-3acc-4091-9581-0a77dad1c5b5
    type: similar
  - id: ce6e34ca-966d-41c9-8d93-5b06c8b97a06
    type: derived
status: test
description: This rule flags Windows process creation where a scheduled task references Taskbar\autoit3.exe, and where Service.exe is invoked with specific command-line options. It further narrows matches by looking for an autoit3.exe parent that runs nslookup.exe with TXT queries, and by identifying temporary execution paths under Windows\Temp\DB\ ending in .exe. The behavior matters because it combines persistence and command execution patterns often used by malware for staging and command-and-control discovery. Telemetry relies on process creation events capturing Image, ParentImage, and full CommandLine on Windows hosts.
references:
  - https://web.archive.org/web/20180402134442/https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018C.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/TA/OilRig/proc_creation_win_apt_oilrig_mar18.yml
author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2018-03-23
modified: 2023-03-08
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.defense-impairment
  - attack.g0049
  - attack.t1053.005
  - attack.s0111
  - attack.t1543.003
  - attack.t1112
  - attack.command-and-control
  - attack.t1071.004
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_schtasks:
    CommandLine|contains|all:
      - SC Scheduled Scan
      - \microsoft\Taskbar\autoit3.exe
  selection_temp:
    Image|contains: \Windows\Temp\DB\
    Image|endswith: .exe
  selection_service:
    Image: C:\Windows\system32\Service.exe
    CommandLine|contains:
      - i
      - u
  selection_autoit:
    ParentImage|endswith: \local\microsoft\Taskbar\autoit3.exe
    CommandLine|contains|all:
      - nslookup.exe
      - -q=TXT
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1