huntrule

Windows Task Scheduler: SVR GraphicalProton known malicious scheduled task names

Flags Windows scheduled task creation, update, or deletion when task names match known SVR GraphicalProton backdoor strings.

FreeUnreviewedSigmahighv1
title: "Windows Task Scheduler: SVR GraphicalProton known malicious scheduled task names"
id: 3793a44f-ea8d-4a99-b8a0-dc68b7acecf3
related:
  - id: 8fa65166-f463-4fd2-ad4f-1436133c52e1
    type: similar
  - id: 2bfc1373-0220-4fbd-8b10-33ddafd2a142
    type: derived
status: test
description: This rule identifies Windows Scheduled Tasks events where the task name matches a list of SVR GraphicalProton backdoor–specific task names. Attackers commonly use scheduled tasks for persistence and to run malicious actions at startup or on a schedule. It relies on TaskScheduler telemetry for task created, updated, or deleted events with the associated TaskName values.
author: CISA, Huntrule Team
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Cozy-Bear/win_taskscheduler_apt_cozy_bear_graphical_proton_task_names.yml
date: 2023-12-18
tags:
  - attack.persistence
  - detection.emerging-threats
logsource:
  product: windows
  service: taskscheduler
  definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger'
detection:
  selection:
    EventID:
      - 129
      - 140
      - 141
    TaskName:
      - \defender
      - \Microsoft\DefenderService
      - \Microsoft\Windows\Application Experience\StartupAppTaskCheck
      - \Microsoft\Windows\Application Experience\StartupAppTaskCkeck
      - \Microsoft\Windows\ATPUpd
      - \Microsoft\Windows\Data Integrity Scan\Data Integrity Update
      - \Microsoft\Windows\DefenderUPDService
      - \Microsoft\Windows\IISUpdateService
      - \Microsoft\Windows\Speech\SpeechModelInstallTask
      - \Microsoft\Windows\WiMSDFS
      - \Microsoft\Windows\Windows Defender\Defender Update Service
      - \Microsoft\Windows\Windows Defender\Service Update
      - \Microsoft\Windows\Windows Error Reporting\CheckReporting
      - \Microsoft\Windows\Windows Error Reporting\SubmitReporting
      - \Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStart
      - \Microsoft\Windows\WindowsDefenderService
      - \Microsoft\Windows\WindowsDefenderService2
      - \Microsoft\Windows\WindowsUpdate\Scheduled AutoCheck
      - \Microsoft\Windows\WindowsUpdate\Scheduled Check
      - \WindowUpdate
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule identifies Windows Scheduled Tasks events where the task name matches a list of SVR GraphicalProton backdoor–specific task names. Attackers commonly use scheduled tasks for persistence and to run malicious actions at startup or on a schedule. It relies on TaskScheduler telemetry for task created, updated, or deleted events with the associated TaskName values.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.