Skip to content

Commit 797bcae

Browse files
swachchhanda000nasbench
swachchhanda000
and
nasbench
authored
Merge PR #5900 from @swachchhanda000 - Update Important scheduled task manipulation related rules
update: Important Scheduled Task Deleted or Disabled - Add EventID 142. update: Disable Important Scheduled Task - Add OFN and remove unecessary string binding for increased coverage. update: Delete Important Scheduled Task - Add OFN and remove unecessary string binding for increased coverage. new: System Restore Registry Modification via CommandLine chore: add regression tests for Important scheduled task manipulation rules --------- Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com>
1 parent fcb2aea commit 797bcae

24 files changed

Lines changed: 893 additions & 22 deletions

‎regression_data/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable/7595ba94-cf3b-4471-aa03-4f6baa9e5fad.evtx‎

68 KB
Binary file not shown.

‎regression_data/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable/7595ba94-cf3b-4471-aa03-4f6baa9e5fad.json‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
{
2+
"Event": {
3+
"#attributes": {
4+
"xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
5+
},
6+
"System": {
7+
"Provider": {
8+
"#attributes": {
9+
"Name": "Microsoft-Windows-Security-Auditing",
10+
"Guid": "54849625-5478-4994-A5BA-3E3B0328C30D"
11+
}
12+
},
13+
"EventID": 4701,
14+
"Version": 1,
15+
"Level": 0,
16+
"Task": 12804,
17+
"Opcode": 0,
18+
"Keywords": "0x8020000000000000",
19+
"TimeCreated": {
20+
"#attributes": {
21+
"SystemTime": "2026-03-11T05:16:41.816327Z"
22+
}
23+
},
24+
"EventRecordID": 27732,
25+
"Correlation": {
26+
"#attributes": {
27+
"ActivityID": "8E521E2B-7C26-0003-031F-528E267CDB01"
28+
}
29+
},
30+
"Execution": {
31+
"#attributes": {
32+
"ProcessID": 852,
33+
"ThreadID": 968
34+
}
35+
},
36+
"Channel": "Security",
37+
"Computer": "swachchhanda",
38+
"Security": null
39+
},
40+
"EventData": {
41+
"SubjectUserSid": "S-1-5-21-2555720767-1205513275-3893774561-1001",
42+
"SubjectUserName": "xodih",
43+
"SubjectDomainName": "SWACHCHHANDA",
44+
"SubjectLogonId": "0x3144c",
45+
"TaskName": "\\Microsoft\\Windows\\SystemRestore\\SR",
46+
"TaskContent": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n <RegistrationInfo>\r\n <SecurityDescriptor>D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;FRFX;;;LS)</SecurityDescriptor>\r\n <Source>$(@%systemroot%\\system32\\srrstr.dll,-320)</Source>\r\n <Author>$(@%systemroot%\\system32\\srrstr.dll,-321)</Author>\r\n <Description>$(@%systemroot%\\system32\\srrstr.dll,-322)</Description>\r\n <URI>Microsoft\\Windows\\SystemRestore\\SR</URI>\r\n </RegistrationInfo>\r\n <Principals>\r\n <Principal id=\"LocalSystem\">\r\n <UserId>S-1-5-18</UserId>\r\n </Principal>\r\n </Principals>\r\n <Settings>\r\n <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>\r\n <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n <Enabled>false</Enabled>\r\n <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>\r\n <StartWhenAvailable>true</StartWhenAvailable>\r\n <RunOnlyIfIdle>true</RunOnlyIfIdle>\r\n <IdleSettings>\r\n <StopOnIdleEnd>true</StopOnIdleEnd>\r\n <RestartOnIdle>false</RestartOnIdle>\r\n </IdleSettings>\r\n <UseUnifiedSchedulingEngine>true</UseUnifiedSchedulingEngine>\r\n <MaintenanceSettings>\r\n <Period>P3D</Period>\r\n <Deadline>P3DT1M</Deadline>\r\n <Exclusive>true</Exclusive>\r\n </MaintenanceSettings>\r\n </Settings>\r\n <Triggers />\r\n <Actions Context=\"LocalSystem\">\r\n <Exec>\r\n <Command>%windir%\\system32\\srtasks.exe</Command>\r\n <Arguments>ExecuteScheduledSPPCreation</Arguments>\r\n </Exec>\r\n </Actions>\r\n</Task>",
47+
"ClientProcessStartKey": 2251799813691708,
48+
"ClientProcessId": 5204,
49+
"ParentProcessId": 15816,
50+
"RpcCallClientLocality": 0,
51+
"FQDN": "swachchhanda"
52+
}
53+
}
54+
}

‎regression_data/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable/info.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
id: fbeed033-1556-49ae-881d-1e12e8aceb49
2+
description: N/A
3+
date: 2026-03-11
4+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
5+
rule_metadata:
6+
- id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad
7+
title: Important Scheduled Task Deleted/Disabled
8+
regression_tests_info:
9+
- name: Positive Detection Test
10+
type: evtx
11+
provider: Microsoft-Windows-Sysmon
12+
match_count: 1
13+
path: regression_data/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable/7595ba94-cf3b-4471-aa03-4f6baa9e5fad.evtx

‎regression_data/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable/9e3cb244-bdb8-4632-8c90-6079c8f4f16d.evtx‎

68 KB
Binary file not shown.

‎regression_data/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable/9e3cb244-bdb8-4632-8c90-6079c8f4f16d.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"Event": {
3+
"#attributes": {
4+
"xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
5+
},
6+
"System": {
7+
"Provider": {
8+
"#attributes": {
9+
"Name": "Microsoft-Windows-TaskScheduler",
10+
"Guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017"
11+
}
12+
},
13+
"EventID": 142,
14+
"Version": 0,
15+
"Level": 4,
16+
"Task": 142,
17+
"Opcode": 0,
18+
"Keywords": "0x8000000000000000",
19+
"TimeCreated": {
20+
"#attributes": {
21+
"SystemTime": "2026-03-11T05:16:41.815720Z"
22+
}
23+
},
24+
"EventRecordID": 14,
25+
"Correlation": null,
26+
"Execution": {
27+
"#attributes": {
28+
"ProcessID": 1996,
29+
"ThreadID": 15932
30+
}
31+
},
32+
"Channel": "Microsoft-Windows-TaskScheduler/Operational",
33+
"Computer": "swachchhanda",
34+
"Security": {
35+
"#attributes": {
36+
"UserID": "S-1-5-18"
37+
}
38+
}
39+
},
40+
"EventData": {
41+
"#attributes": {
42+
"Name": "TaskDisabled"
43+
},
44+
"TaskName": "\\Microsoft\\Windows\\SystemRestore\\SR",
45+
"UserName": "System"
46+
}
47+
}
48+
}

‎regression_data/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable/info.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
id: 89bcf8d7-2f92-4ae4-9492-bba11f26dd10
2+
description: N/A
3+
date: 2026-03-11
4+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
5+
rule_metadata:
6+
- id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d
7+
title: Important Scheduled Task Deleted or Disabled
8+
regression_tests_info:
9+
- name: Positive Detection Test
10+
type: evtx
11+
provider: Microsoft-Windows-Sysmon
12+
match_count: 1
13+
path: regression_data/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable/9e3cb244-bdb8-4632-8c90-6079c8f4f16d.evtx

‎regression_data/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification/7c06ab9b-b1d2-4ba9-b06e-09491ded20d9.evtx‎

68 KB
Binary file not shown.

‎regression_data/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification/7c06ab9b-b1d2-4ba9-b06e-09491ded20d9.json‎

Lines changed: 264 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,264 @@
1+
{
2+
"Event": {
3+
"#attributes": {
4+
"xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
5+
},
6+
"System": {
7+
"Provider": {
8+
"#attributes": {
9+
"Name": "Microsoft-Windows-Sysmon",
10+
"Guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9"
11+
}
12+
},
13+
"EventID": 1,
14+
"Version": 5,
15+
"Level": 4,
16+
"Task": 1,
17+
"Opcode": 0,
18+
"Keywords": "0x8000000000000000",
19+
"TimeCreated": {
20+
"#attributes": {
21+
"SystemTime": "2026-03-11T05:43:26.345335Z"
22+
}
23+
},
24+
"EventRecordID": 35549,
25+
"Correlation": null,
26+
"Execution": {
27+
"#attributes": {
28+
"ProcessID": 3208,
29+
"ThreadID": 1724
30+
}
31+
},
32+
"Channel": "Microsoft-Windows-Sysmon/Operational",
33+
"Computer": "swachchhanda",
34+
"Security": {
35+
"#attributes": {
36+
"UserID": "S-1-5-18"
37+
}
38+
}
39+
},
40+
"EventData": {
41+
"RuleName": "-",
42+
"UtcTime": "2026-03-11 05:43:26.311",
43+
"ProcessGuid": "0197231E-00FE-69B1-981A-000000000800",
44+
"ProcessId": 376,
45+
"Image": "C:\\Windows\\System32\\reg.exe",
46+
"FileVersion": "10.0.26100.1 (WinBuild.160101.0800)",
47+
"Description": "Registry Console Tool",
48+
"Product": "Microsoft® Windows® Operating System",
49+
"Company": "Microsoft Corporation",
50+
"OriginalFileName": "reg.exe",
51+
"CommandLine": "reg add \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\" /v \"DisableConfig\" /t \"REG_DWORD\" /d \"1\" /f",
52+
"CurrentDirectory": "C:\\Windows\\System32\\",
53+
"User": "swachchhanda\\xodih",
54+
"LogonGuid": "0197231E-AB9F-67AA-4C14-030000000000",
55+
"LogonId": "0x3144c",
56+
"TerminalSessionId": 1,
57+
"IntegrityLevel": "High",
58+
"Hashes": "MD5=573EB13AC2BA31E9C2E17FB6DAD14154,SHA256=E295E776FD4F7F73DFAAA5698A19EA7A2F4A2F0C5E1681FAC94E45D00296C926,IMPHASH=A26BCB048DF34CBB422F2656F38634D0",
59+
"ParentProcessGuid": "0197231E-5098-69AE-5814-000000000800",
60+
"ParentProcessId": 15816,
61+
"ParentImage": "C:\\Windows\\System32\\cmd.exe",
62+
"ParentCommandLine": "cmd.exe",
63+
"ParentUser": "swachchhanda\\xodih"
64+
}
65+
}
66+
}
67+
{
68+
"Event": {
69+
"#attributes": {
70+
"xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
71+
},
72+
"System": {
73+
"Provider": {
74+
"#attributes": {
75+
"Name": "Microsoft-Windows-Sysmon",
76+
"Guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9"
77+
}
78+
},
79+
"EventID": 1,
80+
"Version": 5,
81+
"Level": 4,
82+
"Task": 1,
83+
"Opcode": 0,
84+
"Keywords": "0x8000000000000000",
85+
"TimeCreated": {
86+
"#attributes": {
87+
"SystemTime": "2026-03-11T05:43:26.390084Z"
88+
}
89+
},
90+
"EventRecordID": 35550,
91+
"Correlation": null,
92+
"Execution": {
93+
"#attributes": {
94+
"ProcessID": 3208,
95+
"ThreadID": 1724
96+
}
97+
},
98+
"Channel": "Microsoft-Windows-Sysmon/Operational",
99+
"Computer": "swachchhanda",
100+
"Security": {
101+
"#attributes": {
102+
"UserID": "S-1-5-18"
103+
}
104+
}
105+
},
106+
"EventData": {
107+
"RuleName": "-",
108+
"UtcTime": "2026-03-11 05:43:26.378",
109+
"ProcessGuid": "0197231E-00FE-69B1-991A-000000000800",
110+
"ProcessId": 12068,
111+
"Image": "C:\\Windows\\System32\\reg.exe",
112+
"FileVersion": "10.0.26100.1 (WinBuild.160101.0800)",
113+
"Description": "Registry Console Tool",
114+
"Product": "Microsoft® Windows® Operating System",
115+
"Company": "Microsoft Corporation",
116+
"OriginalFileName": "reg.exe",
117+
"CommandLine": "reg add \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\" /v \"DisableSR\" /t \"REG_DWORD\" /d \"1\" /f",
118+
"CurrentDirectory": "C:\\Windows\\System32\\",
119+
"User": "swachchhanda\\xodih",
120+
"LogonGuid": "0197231E-AB9F-67AA-4C14-030000000000",
121+
"LogonId": "0x3144c",
122+
"TerminalSessionId": 1,
123+
"IntegrityLevel": "High",
124+
"Hashes": "MD5=573EB13AC2BA31E9C2E17FB6DAD14154,SHA256=E295E776FD4F7F73DFAAA5698A19EA7A2F4A2F0C5E1681FAC94E45D00296C926,IMPHASH=A26BCB048DF34CBB422F2656F38634D0",
125+
"ParentProcessGuid": "0197231E-5098-69AE-5814-000000000800",
126+
"ParentProcessId": 15816,
127+
"ParentImage": "C:\\Windows\\System32\\cmd.exe",
128+
"ParentCommandLine": "cmd.exe",
129+
"ParentUser": "swachchhanda\\xodih"
130+
}
131+
}
132+
}
133+
{
134+
"Event": {
135+
"#attributes": {
136+
"xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
137+
},
138+
"System": {
139+
"Provider": {
140+
"#attributes": {
141+
"Name": "Microsoft-Windows-Sysmon",
142+
"Guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9"
143+
}
144+
},
145+
"EventID": 1,
146+
"Version": 5,
147+
"Level": 4,
148+
"Task": 1,
149+
"Opcode": 0,
150+
"Keywords": "0x8000000000000000",
151+
"TimeCreated": {
152+
"#attributes": {
153+
"SystemTime": "2026-03-11T05:43:26.438522Z"
154+
}
155+
},
156+
"EventRecordID": 35551,
157+
"Correlation": null,
158+
"Execution": {
159+
"#attributes": {
160+
"ProcessID": 3208,
161+
"ThreadID": 1724
162+
}
163+
},
164+
"Channel": "Microsoft-Windows-Sysmon/Operational",
165+
"Computer": "swachchhanda",
166+
"Security": {
167+
"#attributes": {
168+
"UserID": "S-1-5-18"
169+
}
170+
}
171+
},
172+
"EventData": {
173+
"RuleName": "-",
174+
"UtcTime": "2026-03-11 05:43:26.429",
175+
"ProcessGuid": "0197231E-00FE-69B1-9A1A-000000000800",
176+
"ProcessId": 2964,
177+
"Image": "C:\\Windows\\System32\\reg.exe",
178+
"FileVersion": "10.0.26100.1 (WinBuild.160101.0800)",
179+
"Description": "Registry Console Tool",
180+
"Product": "Microsoft® Windows® Operating System",
181+
"Company": "Microsoft Corporation",
182+
"OriginalFileName": "reg.exe",
183+
"CommandLine": "reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\" /v \"DisableConfig\" /t \"REG_DWORD\" /d \"1\" /f",
184+
"CurrentDirectory": "C:\\Windows\\System32\\",
185+
"User": "swachchhanda\\xodih",
186+
"LogonGuid": "0197231E-AB9F-67AA-4C14-030000000000",
187+
"LogonId": "0x3144c",
188+
"TerminalSessionId": 1,
189+
"IntegrityLevel": "High",
190+
"Hashes": "MD5=573EB13AC2BA31E9C2E17FB6DAD14154,SHA256=E295E776FD4F7F73DFAAA5698A19EA7A2F4A2F0C5E1681FAC94E45D00296C926,IMPHASH=A26BCB048DF34CBB422F2656F38634D0",
191+
"ParentProcessGuid": "0197231E-5098-69AE-5814-000000000800",
192+
"ParentProcessId": 15816,
193+
"ParentImage": "C:\\Windows\\System32\\cmd.exe",
194+
"ParentCommandLine": "cmd.exe",
195+
"ParentUser": "swachchhanda\\xodih"
196+
}
197+
}
198+
}
199+
{
200+
"Event": {
201+
"#attributes": {
202+
"xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
203+
},
204+
"System": {
205+
"Provider": {
206+
"#attributes": {
207+
"Name": "Microsoft-Windows-Sysmon",
208+
"Guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9"
209+
}
210+
},
211+
"EventID": 1,
212+
"Version": 5,
213+
"Level": 4,
214+
"Task": 1,
215+
"Opcode": 0,
216+
"Keywords": "0x8000000000000000",
217+
"TimeCreated": {
218+
"#attributes": {
219+
"SystemTime": "2026-03-11T05:43:27.502020Z"
220+
}
221+
},
222+
"EventRecordID": 35552,
223+
"Correlation": null,
224+
"Execution": {
225+
"#attributes": {
226+
"ProcessID": 3208,
227+
"ThreadID": 1724
228+
}
229+
},
230+
"Channel": "Microsoft-Windows-Sysmon/Operational",
231+
"Computer": "swachchhanda",
232+
"Security": {
233+
"#attributes": {
234+
"UserID": "S-1-5-18"
235+
}
236+
}
237+
},
238+
"EventData": {
239+
"RuleName": "-",
240+
"UtcTime": "2026-03-11 05:43:27.480",
241+
"ProcessGuid": "0197231E-00FF-69B1-9B1A-000000000800",
242+
"ProcessId": 13620,
243+
"Image": "C:\\Windows\\System32\\reg.exe",
244+
"FileVersion": "10.0.26100.1 (WinBuild.160101.0800)",
245+
"Description": "Registry Console Tool",
246+
"Product": "Microsoft® Windows® Operating System",
247+
"Company": "Microsoft Corporation",
248+
"OriginalFileName": "reg.exe",
249+
"CommandLine": "reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\" /v \"DisableSR\" /t \"REG_DWORD\" /d \"1\" /f",
250+
"CurrentDirectory": "C:\\Windows\\System32\\",
251+
"User": "swachchhanda\\xodih",
252+
"LogonGuid": "0197231E-AB9F-67AA-4C14-030000000000",
253+
"LogonId": "0x3144c",
254+
"TerminalSessionId": 1,
255+
"IntegrityLevel": "High",
256+
"Hashes": "MD5=573EB13AC2BA31E9C2E17FB6DAD14154,SHA256=E295E776FD4F7F73DFAAA5698A19EA7A2F4A2F0C5E1681FAC94E45D00296C926,IMPHASH=A26BCB048DF34CBB422F2656F38634D0",
257+
"ParentProcessGuid": "0197231E-5098-69AE-5814-000000000800",
258+
"ParentProcessId": 15816,
259+
"ParentImage": "C:\\Windows\\System32\\cmd.exe",
260+
"ParentCommandLine": "cmd.exe",
261+
"ParentUser": "swachchhanda\\xodih"
262+
}
263+
}
264+
}

0 commit comments

Comments
 (0)