Rule: Rare scheduled task installs

2024-11-07 01:45:21 +00:00 · 2017-03-17 08:41:27 +01:00 · 2017-03-17 08:41:27 +01:00 · e46ecd2aff
commit e46ecd2aff
parent 3a7652fff9
1 changed files with 15 additions and 0 deletions
--- a/rules/windows/other/win_rare_schtask_creation.yml
+++ b/rules/windows/other/win_rare_schtask_creation.yml
@ -0,0 +1,15 @@
+title: Rare Scheduled Task Creations
+status: experimental
+description:  
+author: Florian Roth
+logsource:
+    product: windows
+    service: microsoft-windows-taskscheduler
+detection:
+    selection:
+        EventID: 106
+    timeframe: 7d
+    condition: selection | count() by TaskName < 5 
+falsepositives:
+    - Software installation
+level: low