Windows Task Scheduler schtasks.exe /change /TN /RU /RP Seen Indicating BearLPE Attempts

title: Windows Task Scheduler schtasks.exe /change /TN /RU /RP Seen Indicating BearLPE Attempts
id: 27b34f72-66d6-434d-a91e-cf9ada4e211a
status: test
description: This rule identifies Windows process executions of schtasks.exe that include the /change, /TN, /RU, and /RP arguments together, matching an attempt to modify a scheduled task. Such task configuration changes are a common lever for gaining or retaining elevated execution, so correlating these arguments can highlight potential exploitation activity. The detection relies on Windows process creation telemetry, specifically the Image/OriginalFileName and CommandLine fields.
references:
  - https://github.com/djhohnstein/polarbearrepo/blob/f26d3e008093cc5c835e92a7165170baf6713d43/bearlpe/polarbear/polarbear/exploit.cpp
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Exploits/BearLPE-Exploit/proc_creation_win_exploit_other_bearlpe.yml
author: Olaf Hartong, Huntrule Team
date: 2019-05-22
modified: 2023-01-26
tags:
  - attack.persistence
  - attack.execution
  - attack.privilege-escalation
  - attack.t1053.005
  - car.2013-08-001
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \schtasks.exe
    - OriginalFileName: schtasks.exe
  selection_cli:
    CommandLine|contains|all:
      - /change
      - /TN
      - /RU
      - /RP
  condition: all of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 931b6802-d6a6-4267-9ffa-526f57f22aaf
    type: derived