Windows Registry Event: Scheduled TaskCache Tree Key Creation for TeamCity Exploitation

title: "Windows Registry Event: Scheduled TaskCache Tree Key Creation for TeamCity Exploitation"
id: d28dea95-48f2-477a-a28e-fdf88d83df2a
status: test
description: This rule matches Windows registry events where the TargetObject contains specific paths under the TaskCache Tree key and includes a TeamCity settings UI string. Attackers can leverage scheduled tasks to persist or execute actions during exploitation workflows, making these registry artifacts valuable indicators. Detection relies on telemetry that records registry event TargetObject values for matching keys.
references:
  - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Diamond-Sleet/registry_event_apt_diamond_sleet_scheduled_task.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-24
tags:
  - attack.defense-impairment
  - attack.t1685
  - detection.emerging-threats
logsource:
  product: windows
  category: registry_event
detection:
  selection:
    TargetObject|contains|all:
      - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\
      - Windows TeamCity Settings User Interface
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 9f9f92ba-5300-43a4-b435-87d1ee571688
    type: derived