KQL Search

Query Details

Suspicious Scheduled Tasks From LOCALAPPDATA

Query

//Whitelisted Paths
let WhitelistedPaths = dynamic([
    "\\AppData\\Local\\Chrome\\User Data",
    "\\AppData\\Local\\Microsoft\\Teams\\current",
    "\\AppData\\Local\\ZoomMeetings\\bin",
    "\\AppData\\Local\\Google\\GoogleUpdater\\",
    "\\AppData\\Local\\Opera\\autoupdate\\opera_autoupdate.exe"
]);
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in ("svchost.exe", "taskeng.exe")
| where InitiatingProcessCommandLine has_all ("netsvcs", "Schedule") or InitiatingProcessFileName == "taskeng.exe"
| where FolderPath matches regex @"(?i)C:\\Users\\.*\\AppData\\Local\\.*"
// Substring-based Whitelisting
| where not(FolderPath has_any (WhitelistedPaths))
| extend TaskSource = iff(InitiatingProcessFileName == "svchost.exe", "Scheduled Task (svchost)", "Scheduled Task (taskeng)")
| invoke FileProfile(SHA1)
| where GlobalPrevalence < 30000
| order by Timestamp desc

About this query

Suspicious Scheduled Tasks from %LOCALAPPDATA%

Query Information

MITRE ATT&CK Technique(s)

Technique IDTitleLink
T1053.005Scheduled Taskshttps://attack.mitre.org/techniques/T1053/005

Description

This rule detects suspicious scheduled tasks that execute binaries from the AppData\Local folder, which is a common location for user-specific applications and can be abused by adversaries for persistence. Such behavior is often used by Infostealer Malware. The rule specifically looks for processes initiated by 'svchost.exe' or 'taskeng.exe' with command lines indicating scheduled task execution, and then filters out a whitelist of known legitimate applications that operate from this directory. It also incorporates a global prevalence check to further reduce false positives.

Author <Optional>

References

Defender XDR

Explanation

This query is designed to identify potentially suspicious scheduled tasks on a system that execute programs from the %LOCALAPPDATA% directory. Here's a simplified breakdown of what the query does:

  1. Purpose: The query aims to detect suspicious activities where scheduled tasks are used to run programs from the AppData\Local folder. This folder is often used by user-specific applications and can be exploited by malware, such as Infostealers, to maintain persistence on a system.

  2. Detection Method:

    • The query looks for processes that are started by either svchost.exe or taskeng.exe, which are common executables used for running scheduled tasks.
    • It checks if these processes have command lines that include "netsvcs" and "Schedule" or are specifically initiated by taskeng.exe.
    • It filters for file paths that match the pattern of being within the AppData\Local directory.

  3. Whitelisting:

    • The query includes a list of known legitimate paths (whitelisted paths) where applications like Chrome, Teams, Zoom, Google Updater, and Opera are typically installed. It excludes these paths from being flagged as suspicious to reduce false positives.

  4. Prevalence Check:

    • It uses a global prevalence check to further filter out common files that are unlikely to be malicious. Files with a global prevalence of less than 30,000 are considered more suspicious.

  5. Output:

    • The query extends the results with a TaskSource field to indicate whether the task was initiated by svchost.exe or taskeng.exe.
    • It orders the results by the most recent timestamp to show the latest suspicious activities first.

Overall, this query helps security analysts identify unusual scheduled tasks that could indicate malicious activity, while minimizing false alarms by excluding known legitimate applications and common files.