Update ScheduleTaskHide.yaml
Removing non-ascii character
This commit is contained in:
Родитель
eb39df6859
Коммит
90932f1fda
|
@ -1,7 +1,7 @@
|
|||
id: 6dd2629c-534b-4275-8201-d7968b4fa77e
|
||||
name: Scheduled Task Hide
|
||||
description: |
|
||||
'This query detects attempts by malware to hide the scheduled task by deleting the SD (Security Descriptor) value. Removal of SD value results in the scheduled task “disappearing” from “schtasks /query” and Task Scheduler.
|
||||
'This query detects attempts by malware to hide the scheduled task by deleting the SD (Security Descriptor) value. Removal of SD value results in the scheduled task disappearing from schtasks /query and Task Scheduler.
|
||||
The query requires auditing to be turned on for HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree registry hive as well as audit policy for registry auditing to be turned on.
|
||||
Reference: https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/
|
||||
Reference: https://4sysops.com/archives/audit-changes-in-the-windows-registry/'
|
||||
|
@ -44,4 +44,4 @@ entityMappings:
|
|||
- identifier: FullName
|
||||
columnName: HostCustomEntity
|
||||
version: 1.0.0
|
||||
kind: Scheduled
|
||||
kind: Scheduled
|
||||
|
|
Загрузка…
Ссылка в новой задаче