Remote Scheduled Task Creation¶
Metadata¶
Author |
Roberto Rodriguez @Cyb3rWard0g |
Creation Date |
2020/12/19 |
Modification Date |
2020/12/19 |
Tactics |
|
Techniques |
[‘T1053.005’] |
Tags |
None |
Dataset Description¶
This dataset represents a threat actor creating a scheduled task remotely using schtasks.
Datasets Downloads¶
Dataset Type |
Link |
---|---|
Host |
|
Network |
Simulation Plan¶
Environment |
Tool Type |
Module |
---|---|---|
Lab VM |
Manual |
Cmd |
Adversary View¶
PS C:\windows\system32> C:\Windows\system32\cmd.exe /C schtasks /create /F /tn "\Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager" /tr "C:\Windows\system32\cmd.exe /C C:\Windows\System32\notepad.exe" /sc ONSTART /ru system /S WORKSTATION6
SUCCESS: The scheduled task "\Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager" has successfully been created.
PS C:\windows\system32>
Explore Mordor Dataset¶
Initialize Analytics Engine¶
from openhunt.mordorutils import *
spark = get_spark()
Download & Process Mordor File¶
mordor_file = "https://raw.githubusercontent.com/OTRF/mordor/master/datasets/small/windows/lateral_movement/host/schtask_create.zip"
registerMordorSQLTable(spark, mordor_file, "mordorTable")
[+] Processing a Spark DataFrame..
[+] DataFrame Returned !
[+] Temporary SparkSQL View: mordorTable
Get to know your data¶
df = spark.sql(
'''
SELECT Hostname,Channel,EventID, Count(*) as count
FROM mordorTable
GROUP BY Hostname,Channel,EventID
ORDER BY count DESC
'''
)
df.show(truncate=False)
+---------------------------+------------------------------------+-------+-----+
|Hostname |Channel |EventID|count|
+---------------------------+------------------------------------+-------+-----+
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|7 |230 |
|WORKSTATION6.theshire.local|Microsoft-Windows-Sysmon/Operational|10 |228 |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|10 |176 |
|WORKSTATION6.theshire.local|Microsoft-Windows-Sysmon/Operational|7 |161 |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|13 |21 |
|WORKSTATION5.theshire.local|Security |4658 |18 |
|WORKSTATION6.theshire.local|Microsoft-Windows-Sysmon/Operational|13 |18 |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|12 |16 |
|WORKSTATION6.theshire.local|Microsoft-Windows-Sysmon/Operational|12 |12 |
|WORKSTATION5.theshire.local|Security |4656 |11 |
|WORKSTATION6.theshire.local|Security |4658 |10 |
|WORKSTATION5.theshire.local|Security |4690 |10 |
|WORKSTATION6.theshire.local|Security |5156 |9 |
|WORKSTATION5.theshire.local|Security |4663 |9 |
|WORKSTATION5.theshire.local|Security |5158 |8 |
|WORKSTATION5.theshire.local|Security |5156 |8 |
|WORKSTATION6.theshire.local|Security |5158 |7 |
|WORKSTATION5.theshire.local|Security |4688 |6 |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|11 |6 |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|1 |6 |
+---------------------------+------------------------------------+-------+-----+
only showing top 20 rows