Windows Security Event 4698 Scheduled Task Creation for TeamCity Settings UI

title: Windows Security Event 4698 Scheduled Task Creation for TeamCity Settings UI
id: 3d029d54-4a55-416d-9382-d501b188714a
status: test
description: This rule matches Windows Security audit events (EventID 4698) that indicate creation of a scheduled task named '\Windows TeamCity Settings User Interface' with task content containing the specific string 'uTYNkfKxHiZrx3KJ'. Attackers can use scheduled tasks for persistence by having malicious actions run automatically under Windows. Detection relies on Security log telemetry that includes the task name and the task content embedded in the event record.
references:
  - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Diamond-Sleet/win_security_apt_diamond_sleet_scheduled_task.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-24
tags:
  - attack.execution
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1053.005
  - detection.emerging-threats
logsource:
  product: windows
  service: security
  definition: The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data.
detection:
  selection:
    EventID: 4698
    TaskName: \Windows TeamCity Settings User Interface
    TaskContent|contains: uTYNkfKxHiZrx3KJ
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 3b8e5084-4de9-449a-a40d-0e11014f2e2d
    type: derived