Windows Security 4702 Scheduled Task Content Change with Suspicious Strings

title: Windows Security 4702 Scheduled Task Content Change with Suspicious Strings
id: 692602c3-c9df-4fff-aa3c-9200f95ef52f
related:
  - id: 1c0e41cd-21bb-4433-9acc-4a2cd6367b9b
    type: similar
  - id: 614cf376-6651-47c4-9dcc-6b9527f749f4
    type: derived
status: test
description: This rule flags Windows Security EventID 4702 instances where a scheduled task update includes task content or command text containing high-risk keywords and paths. Attackers commonly modify scheduled tasks to persist and to execute payloads via command interpreters, scripting engines, or utility-based living-off-the-land binaries. The detection relies on Security audit telemetry for event 4702 and string matches within the newly written scheduled task content field.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_scheduled_task_update.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-05
tags:
  - attack.execution
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1053.005
logsource:
  product: windows
  service: security
  definition: The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data.
detection:
  selection_eid:
    EventID: 4702
  selection_paths:
    TaskContentNew|contains:
      - \AppData\Local\Temp\
      - \AppData\Roaming\
      - \Users\Public\
      - \WINDOWS\Temp\
      - C:\Temp\
      - \Desktop\
      - \Downloads\
      - \Temporary Internet
      - C:\ProgramData\
      - C:\Perflogs\
  selection_commands:
    TaskContentNew|contains:
      - regsvr32
      - rundll32
      - cmd.exe</Command>
      - cmd</Command>
      - "<Arguments>/c "
      - "<Arguments>/k "
      - "<Arguments>/r "
      - powershell
      - pwsh
      - mshta
      - wscript
      - cscript
      - certutil
      - bitsadmin
      - bash.exe
      - "bash "
      - scrcons
      - "wmic "
      - wmic.exe
      - forfiles
      - scriptrunner
      - hh.exe
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1