Windows: Scheduled Task Payload Execution via cmd/powershell System EventID Wrapper

title: "Windows: Scheduled Task Payload Execution via cmd/powershell System EventID Wrapper"
id: f81f3ca0-df4c-4cf8-9430-bd19552aac5b
status: test
description: This rule identifies process creations where cmd.exe or powershell.exe runs commands containing a specific System/EventID event wrapper and scheduled task creation arguments. The pattern includes creating and deleting an event, using the /ec and /so parameters, and naming a task as "run", which attackers can use to trigger backdoor payload execution via scheduled task. Telemetry relies on Windows process creation records with the process image path and full command line content.
references:
  - https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Malware/Serpent-Backdoor/proc_creation_win_malware_serpent_backdoor_payload_execution.yml
author: "@kostastsale, Huntrule Team"
date: 2022-03-21
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.005
  - attack.t1059.006
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - \cmd.exe
      - \powershell.exe
    CommandLine|contains|all:
      - "[System/EventID="
      - /create
      - /delete
      - /ec
      - /so
      - /tn run
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: d5eb7432-fda4-4bba-a37f-ffa74d9ed639
    type: derived