Remote Scheduled Task Creation¶

Metadata¶


Author	Roberto Rodriguez @Cyb3rWard0g
Creation Date	2020/12/19
Modification Date	2020/12/19
Tactics	[‘TA0002’, ‘TA0003’, ‘TA0004’, ‘TA0008’]
Techniques	[‘T1053.005’]
Tags	None

Dataset Description¶

This dataset represents a threat actor creating a scheduled task remotely using schtasks.

Datasets Downloads¶

Dataset Type	Link
Host	https://raw.githubusercontent.com/OTRF/mordor/master/datasets/small/windows/lateral_movement/host/schtask_create.zip
Network	https://raw.githubusercontent.com/OTRF/mordor/master/datasets/small/windows/lateral_movement/network/schtask_create.zip

Notebooks¶

Notebooks created by the community leveraging the mordor datasets

Author	Name	Link

Simulation Plan¶

Environment	Tool Type	Module
Lab VM	Manual	Cmd

Adversary View¶

PS C:\windows\system32> C:\Windows\system32\cmd.exe /C schtasks /create /F /tn "\Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager" /tr "C:\Windows\system32\cmd.exe /C C:\Windows\System32\notepad.exe" /sc ONSTART /ru system /S WORKSTATION6
SUCCESS: The scheduled task "\Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager" has successfully been created.
PS C:\windows\system32> 

Explore Mordor Dataset¶

Initialize Analytics Engine¶

from openhunt.mordorutils import *
spark = get_spark()

Download & Process Mordor File¶

mordor_file = "https://raw.githubusercontent.com/OTRF/mordor/master/datasets/small/windows/lateral_movement/host/schtask_create.zip"
registerMordorSQLTable(spark, mordor_file, "mordorTable")

[+] Processing a Spark DataFrame..
[+] DataFrame Returned !
[+] Temporary SparkSQL View: mordorTable 

Get to know your data¶

df = spark.sql(
'''
SELECT Hostname,Channel,EventID, Count(*) as count
FROM mordorTable
GROUP BY Hostname,Channel,EventID
ORDER BY count DESC
'''
)
df.show(truncate=False)

+---------------------------+------------------------------------+-------+-----+
|Hostname                   |Channel                             |EventID|count|
+---------------------------+------------------------------------+-------+-----+
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|7      |230  |
|WORKSTATION6.theshire.local|Microsoft-Windows-Sysmon/Operational|10     |228  |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|10     |176  |
|WORKSTATION6.theshire.local|Microsoft-Windows-Sysmon/Operational|7      |161  |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|13     |21   |
|WORKSTATION5.theshire.local|Security                            |4658   |18   |
|WORKSTATION6.theshire.local|Microsoft-Windows-Sysmon/Operational|13     |18   |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|12     |16   |
|WORKSTATION6.theshire.local|Microsoft-Windows-Sysmon/Operational|12     |12   |
|WORKSTATION5.theshire.local|Security                            |4656   |11   |
|WORKSTATION6.theshire.local|Security                            |4658   |10   |
|WORKSTATION5.theshire.local|Security                            |4690   |10   |
|WORKSTATION6.theshire.local|Security                            |5156   |9    |
|WORKSTATION5.theshire.local|Security                            |4663   |9    |
|WORKSTATION5.theshire.local|Security                            |5158   |8    |
|WORKSTATION5.theshire.local|Security                            |5156   |8    |
|WORKSTATION6.theshire.local|Security                            |5158   |7    |
|WORKSTATION5.theshire.local|Security                            |4688   |6    |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|11     |6    |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|1      |6    |
+---------------------------+------------------------------------+-------+-----+
only showing top 20 rows

Empire Invoke PSRemoting Covenant SharpSC Create