huntrule

Windows Scheduled Task Creation Using SVR-Specific Task Names

Alerts on Windows scheduled task events with SVR-associated task names indicative of persistence.

FreeUnreviewedSigmahighv1
title: Windows Scheduled Task Creation Using SVR-Specific Task Names
id: a9342a9e-548e-47aa-a09c-a25c630607d6
related:
  - id: 2bfc1373-0220-4fbd-8b10-33ddafd2a142
    type: similar
  - id: 8fa65166-f463-4fd2-ad4f-1436133c52e1
    type: derived
status: test
description: This rule flags Windows Security events where a scheduled task is created, modified, or registered with task names known to be used by SVR for the GraphicalProton backdoor. Attackers rely on scheduled tasks to maintain persistence and execute malicious activity automatically. The detection uses Windows Security event telemetry (EventIDs 4698, 4699, and 4702) and matches the task name against a predefined list.
author: CISA, Huntrule Team
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Cozy-Bear/win_security_apt_cozy_bear_scheduled_tasks_name.yml
date: 2023-12-18
tags:
  - attack.persistence
  - detection.emerging-threats
logsource:
  service: security
  product: windows
detection:
  selection:
    EventID:
      - 4698
      - 4699
      - 4702
    TaskName:
      - \defender
      - \Microsoft\DefenderService
      - \Microsoft\Windows\Application Experience\StartupAppTaskCheck
      - \Microsoft\Windows\Application Experience\StartupAppTaskCkeck
      - \Microsoft\Windows\ATPUpd
      - \Microsoft\Windows\Data Integrity Scan\Data Integrity Update
      - \Microsoft\Windows\DefenderUPDService
      - \Microsoft\Windows\IISUpdateService
      - \Microsoft\Windows\Speech\SpeechModelInstallTask
      - \Microsoft\Windows\WiMSDFS
      - \Microsoft\Windows\Windows Defender\Defender Update Service
      - \Microsoft\Windows\Windows Defender\Service Update
      - \Microsoft\Windows\Windows Error Reporting\CheckReporting
      - \Microsoft\Windows\Windows Error Reporting\SubmitReporting
      - \Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStart
      - \Microsoft\Windows\WindowsDefenderService
      - \Microsoft\Windows\WindowsDefenderService2
      - \Microsoft\Windows\WindowsUpdate\Scheduled AutoCheck
      - \Microsoft\Windows\WindowsUpdate\Scheduled Check
      - \WindowUpdate
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags Windows Security events where a scheduled task is created, modified, or registered with task names known to be used by SVR for the GraphicalProton backdoor. Attackers rely on scheduled tasks to maintain persistence and execute malicious activity automatically. The detection uses Windows Security event telemetry (EventIDs 4698, 4699, and 4702) and matches the task name against a predefined list.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.