Skip to content

Commit

Permalink
Merge PR #4983 from @swachchhanda000 - Add `Task Scheduler DLL Loaded…
Browse files Browse the repository at this point in the history
… By Application Located In Potentially Suspicious Location`

new: Task Scheduler DLL Loaded By Application Located In Potentially Suspicious Location

---------

Co-authored-by: nasbench <[email protected]>
  • Loading branch information
swachchhanda000 and nasbench authored Sep 2, 2024
1 parent b86a494 commit 7f0f7ee
Showing 1 changed file with 35 additions and 0 deletions.
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
title: Task Scheduler DLL Loaded By Application Located In Potentially Suspicious Location
id: 3b92a1d0-8d4b-4d28-a1b4-1e29d49a6a3e
status: experimental
description: |
Detects the loading of the "taskschd.dll" module from a process that located in a potentially suspicious or uncommon directory.
The loading of this DLL might indicate that the application have the capability to create a scheduled task via the "Schedule.Service" COM object.
Investigation of the loading application and its behavior is required to determining if its malicious.
references:
- https://www.logpoint.com/en/blog/shenanigans-of-scheduled-tasks/
- https://x.com/Max_Mal_/status/1826179497084739829
author: Swachchhanda Shrawan Poudel
date: 2024-09-02
tags:
- attack.persistence
- attack.execution
- attack.t1053.005
logsource:
category: image_load
product: windows
detection:
selection_dll:
- ImageLoaded|endswith: '\taskschd.dll'
- OriginalFileName: 'taskschd.dll'
selection_paths:
Image|contains:
- ':\Temp\'
- ':\Users\Public\'
- ':\Windows\Temp\'
- '\AppData\Local\Temp\'
- '\Desktop\'
- '\Downloads\'
condition: all of selection_*
falsepositives:
- Some installers might generate false positives, apply additional filters accordingly.
level: low

0 comments on commit 7f0f7ee

Please sign in to comment.