Windows Process Creation: Renamed jusched.exe Execution via Java Scheduler Names

title: "Windows Process Creation: Renamed jusched.exe Execution via Java Scheduler Names"
id: 1f116461-97dc-4e23-b866-004ddb4aa85c
status: test
description: This rule flags Windows process creation events where the process description matches Java Update Scheduler variants, but the executable name ends with \jusched.exe. Attackers may rename or masquerade legitimate-sounding binaries to blend in with expected system activity. The detection relies on Windows process creation telemetry, matching the Description field and enforcing an executable path suffix of \jusched.exe while excluding a specific image filter.
references:
  - https://www.bitdefender.com/files/News/CaseStudies/study/262/Bitdefender-WhitePaper-An-APT-Blueprint-Gaining-New-Visibility-into-Financial-Threats-interactive.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_jusched.yml
author: Markus Neis, Swisscom, Huntrule Team
date: 2019-06-04
modified: 2023-02-03
tags:
  - attack.execution
  - attack.stealth
  - attack.t1036.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Description:
      - Java Update Scheduler
      - Java(TM) Update Scheduler
  filter:
    Image|endswith: \jusched.exe
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: edd8a48c-1b9f-4ba1-83aa-490338cd1ccb
    type: derived