merge task schedule persistence with existing rule

mandiant · Dec 3, 2024 · b39b921 · b39b921
1 parent 33cb866
commit b39b921
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 33 deletions.
diff --git a/nursery/persist-via-task-scheduler.yml b/nursery/persist-via-task-scheduler.yml
diff --git a/persistence/scheduled-tasks/schedule-task-via-schtasks.yml b/persistence/scheduled-tasks/schedule-task-via-schtasks.yml
@@ -4,18 +4,29 @@ rule:
     namespace: persistence/scheduled-tasks
     authors:
       - [email protected]
+      - [email protected]
     scopes:
       static: function
       dynamic: thread
     att&ck:
       - Persistence::Scheduled Task/Job::Scheduled Task [T1053.005]
+    references:
+      - https://learn.microsoft.com/en-us/windows/win32/taskschd/task-scheduler-start-page
+      - https://stmxcsr.com/persistence/scheduled-tasks.html
     examples:
       - 79cde1aa711e321b4939805d27e160be:0x401440
   features:
-    - and:
-      - match: host-interaction/process/create
-      - or:
-        - and:
-          - string: /schtasks/i
-          - string: /\/create /i
-        - string: /Register-ScheduledTask /i
+    - or:
+      - and:
+        - match: set registry value
+        - string: /Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\/i
+        - string: /^Actions$/i
+      - and:
+        - match: host-interaction/process/create
+        - or:
+          - and:
+            - string: /schtasks/i
+            - or:
+              - string: /\/change/i
+              - string: /\/create/i
+          - string: /Register-ScheduledTask /i