In this final section,
we'll be looking at how Windows scheduled tasks can be used to
establish a persistent foothold on a compromised machine.
Installing a scheduled task on Windows or a cron job in Linux is an easy
and effective way for an attacker to maintain a foothold.
In contrast to installing a permanent backdoor process,
intermittent jobs are often harder to see.
In the demo,
we'll be looking at detecting the creation of
possibly malicious scheduled tasks,
extracting and viewing the task parameters including tracing
configuration that was dynamically loaded by the task,
and understanding the purpose of the attack.
First, let's look at finding scheduled task creation events.
We're going to be working with multiple event types.
Your SOC environment may have these in a single table,
but more likely,
you will have to query the event types separately and
combine them into a single dataframe.
Assuming that we query the events from the host for our investigation timeline,
let's see how you might identify places to look for attempts to use
scheduled tasks to gain a persistent foothold.
We're going to plot a simple count of unique
EventIds occurring in 5‑minute windows.
The horizontal axis is time,
the vertical is the number of unique event types seen in each 5‑minute window.
Lots of different EventIds firing in close proximity
can indicate attacker activity.
Their actions can include, for example, creating or modifying groups or accounts,
changes to the audit policy, installing or disabling a service,
or installing a scheduled task.
You can write this grouping and counting logic in a query and
have it execute in your database engine,
much as we did in the first demo.
Here,
we're going to apply this grouping and counting locally using pandas
to the dataframe containing our multiple events.
Plotting this data shows a very clear spike at around 3 a.m.
At this time,
more than double the number of event types fired compared with any other time.
Using MSTICPy's timeline, we can view the same data,
but it gives us a greater understanding of exactly which
event types were firing during the spike.
There is a very clear band of event types in the middle of the plot,
and we can see several event types that didn't occur at
any other time in this 24‑hour period.
Among these events are EventIds 106 and 4698,
both of which indicate the creation of scheduled tasks.
There are other approaches to finding scheduled task creation.
One is searching for the schtasks command‑line tool
in processed command line events.
This Windows tool is frequently seen in attacks groups; however,
there are several other ways to create tasks using WMI or PowerShell,
for example, so don't rely on this.
In our case,
this simple search for the Task Scheduler tool did
find a seemingly suspicious event.
If, however, you see EventIds 106 and 4698,
but no corresponding use of the Task Scheduler tool,
you will need to do a little bit more hunting for processes executing at the
time of the task creation to see which was responsible.
Looking at the command line for this process,
it isn't formatted in a very readable way.
Let's make it a bit clearer using Python's string replace
function to add some line breaks and formatting.
We see that the task created is set to run PowerShell each day.
The parameter list passed the PowerShell is a little curious, though.
Deciphering this tells us that it is reading data from a registry
value and executing that. Before we dig deeper,
a few words on task creation events.
EventId 106 is useful for knowing that a task has been created,
but doesn't tell as much about what the task was.
Event 4698, however, has the task parameters in the TaskContent field.
This field is stored using HTML or XML encoding, so it isn't very pretty.
You can use Python's HTML library to unescape the XML entities
and show the task parameters more clearly.
Having done that,
we can see in the Exec element, the same PowerShell command that we saw in
the process creation event a few moments ago. The 4698 event will show this
detail regardless of how the task was created.