Hello and welcome to another
application of the minor attack
framework discussion today
we're looking at scheduled
tasks or task in the
case of how modern names and
what they can be used for.
So with that, let's go ahead and
jump right into our objectives.
So today's objectives are as
follows.
We're going to describe what a
scheduled task is.
How has scheduled past been used
for attack purposes?
What are some mitigation techniques
and what are some detection
techniques?
So simply put, a scheduled
task is a threat.
Actor is able to
utilize or can utilize utilities
such as ATX and
Associates for scheduled tasks
in addition to the Windows scheduled
or task scheduler to schedule
payload scripts or programs to run
and a certain date and time.
So we've seen before where this
can be used for persistence,
it can be used to elevate privilege.
It just depends on how
the schedule task runs and what it's
able to do.
So some additional examples of this
are variants, which is
a Trojan, which has the capability
to take over a system.
And so this particular Trojan
variant uses schedule or
the task scheduler to
execute and get
a foothold in the network, Bamidele
or Amatol as a
click fraud Trojan that
will attempt to escalate privilege
using the task scheduler as well.
Overall, the problem
with these methods is that if you're
not going and looking
in task scheduler
and schedule tasks,
the threat actor can continue
continuously reinfect the system.
And so if you do a virus scan
and it does it check the test
schedule or you don't do any
additional evaluation and
you think you've cleaned the system
and then the system reboots
the task schedule or runs
it, does the process that originally
infected the system and
now you're back at square one.
So you've got to pay attention to
these areas if you think you're
dealing with a compromised system,
because it's potential
there's a potential likelihood that
a threat actors using it to
reinfect or maintain some level
of persistence in the system.
So what are some ways that we can
mitigate the use
of scheduled task for doing this?
Well, we have looked at PowerPoint.
We discussed it at least, and we're
going to look at it.
But it's one of a few tools
that you can use to find system
permission, weaknesses and scheduled
tests prior to them being taken
advantage of. So, again,
not necessarily a automated
mitigation process or technique,
but a relatively low cost
way that you can take a tool,
run it and
validate whether or not there are
areas within scheduled tasks
that could be taken advantage of.
And then if you get rid of those
areas or at least shore them up,
that's one less way that a threat
actor could potentially compromise
your system.
We can for scheduled tasks to run
under the authenticated account
instead of system.
So that could cause
issues potentially for
administrators.
It may add some additional overhead.
You may have to do some research on
services and it may be a little
easier said than done.
But if you can manage it, then
this could definitely limit the
threat actors capability to escalate
their privileges through scheduled
tasks and then limit
user privileges to those necessary
to achieve their business functions.
Again, nine times
out of ten threats are introduced
or threat actors are introduced into
our network or given access to our
network through the unintentional
interactions that users have with
what they think are legitimate
communications, phishing, emails,
sites, websites, just general web
browsing. Again, if I get
escalated privileges and I'm using
that account for day to day use,
going through a website, something
of that nature and accidentally
click malicious ad or link,
then I can introduce an infection
into the environment that really
circumvents any controls that
and the right actor would need to
bypass otherwise.
So what are some detection
techniques that we can use in this
instance?
Well, we can alert on
scheduled task creation from the
command line, so a
lot of times, again, foreign actors
are trying to avoid detection and
arousing suspicion.
So in this case, if we
get alerted
whenever a scheduled task is created
by a command line, that's
something that we can investigate
and look at.
We can monitor for process execution
from the task scheduler as well.
And we can also configure event
long enough for scheduled task
creation and changes.
So these are just a few examples
of some event IDs that you would
want to look for and
alert on. Again,
a legitimate administrator may
create a scheduled task from command
line because they don't want to
interrupt the user environment,
whatever the case may be.
So part of this is going to be
validating that that activity
is from legitimate
operations and that it's not
again, it's threat actor doing
something to try and cement
themselves into a system or
elevate their privilege.
So with that, let's go ahead and do
a quick check on learning.
True or false, scheduled
tasks can be used to reinfect
the system once it is cleaned
up.
So if you need some additional time
to consider the question, please
post the video.
So true or false, scheduled tasks
can be used to reinfect a system
once it is cleaned up.
So we indicated this earlier
that yes, in fact, a scheduled task
can be used to reinfect the system
once it is cleaned up.
And the reason for that is, is that
if you don't check scheduled tasks,
you don't get rid of those tasks
that allow the the threat actor to
reinfect the system or re download
a payload, whatever the case may be,
even if you get rid of the original
payload, the way in which they got
that payload, there may not have
been removed. And so this is
a true statement.
So in summary of today's discussion,
we described what scheduled task is,
OK, so essentially the ability
to schedule a task and we could use
that payload on a script,
whatever the case may be.
We talked about how it can be used.
We looked at some mitigation
techniques and we looked
at some detection techniques
as well.
So keep in mind, this privilege is
going to be a consistent thing
across privilege, escalation, being
able to check for areas in the
system where privilege escalation
can be executed is going to continue
to be relevant so
that in themselves will help
to combat a
number of these factors that are a
threat actor could use to take
over our systems or to infect
our network.
So with that in mind, I want to
thank you for your time today,
and I look forward to seeing you
again soon.