Merge PR SigmaHQ#5060 from @MalGamy12 - Update `Schedule Task Creatio…

…n From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE`

Update: Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE - Add additional paths for `:\Users\All Users\` and `:\Users\Default\` 

---------

Co-authored-by: nasbench <[email protected]>

rules/windows/process_creation/proc_creation_win_schtasks_env_folder.yml

@@ -1,4 +1,4 @@
-title: Suspicious Schtasks From Env Var Folder
+title: Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE
 id: 81325ce1-be01-4250-944f-b4789644556f
 related:
     - id: 43f487f0-755f-4c2a-bce7-d6d2eec2fcf8 # TODO: Recreate after baseline
@@ -8,48 +8,51 @@ description: Detects Schtask creations that point to a suspicious folder or an e
 references:
     - https://www.welivesecurity.com/2022/01/18/donot-go-do-not-respawn/
     - https://www.joesandbox.com/analysis/514608/0/html#324415FF7D8324231381BAD48A052F85DF04
+    - https://blog.talosintelligence.com/gophish-powerrat-dcrat/
 author: Florian Roth (Nextron Systems)
 date: 2022-02-21
-modified: 2023-11-30
+modified: 2024-10-28
 tags:
     - attack.execution
     - attack.t1053.005
 logsource:
     product: windows
     category: process_creation
 detection:
-    selection1_create:
+    selection_1_create:
         Image|endswith: '\schtasks.exe'
         CommandLine|contains: ' /create '
-    selection1_all_folders:
+    selection_1_all_folders:
         CommandLine|contains:
             - ':\Perflogs'
+            - ':\Users\All Users\'
+            - ':\Users\Default\'
+            - ':\Users\Public'
             - ':\Windows\Temp'
             - '\AppData\Local\'
             - '\AppData\Roaming\'
-            - '\Users\Public'
             - '%AppData%'
             - '%Public%'
-    selection2_parent:
+    selection_2_parent:
         ParentCommandLine|endswith: '\svchost.exe -k netsvcs -p -s Schedule'
-    selection2_some_folders:
+    selection_2_some_folders:
         CommandLine|contains:
             - ':\Perflogs'
             - ':\Windows\Temp'
             - '\Users\Public'
             - '%Public%'
-    filter_mixed:
-        - CommandLine|contains:
-              - 'update_task.xml'
-              - '/Create /TN TVInstallRestore /TR'
+    filter_optional_other:
         - ParentCommandLine|contains: 'unattended.ini'
-    filter_avira_install:
+        - CommandLine|contains: 'update_task.xml'
+    filter_optional_team_viewer:
+        CommandLine|contains: '/Create /TN TVInstallRestore /TR'
+    filter_optional_avira_install:
         # Comment out this filter if you dont use AVIRA
         CommandLine|contains|all:
             - '/Create /Xml "C:\Users\'
             - '\AppData\Local\Temp\.CR.'
             - 'Avira_Security_Installation.xml'
-    filter_avira_other:
+    filter_optional_avira_other:
         # Comment out this filter if you dont use AVIRA
         CommandLine|contains|all:
             - '/Create /F /TN'
@@ -61,12 +64,12 @@ detection:
             - '.tmp\WatchdogServiceControlManagerTimeout.xml'
             - '.tmp\SystrayAutostart.xml'
             - '.tmp\MaintenanceTask.xml'
-    filter_klite_codec:
+    filter_optional_klite_codec:
         CommandLine|contains|all:
             - '\AppData\Local\Temp\'
             - '/Create /TN "klcp_update" /XML '
             - '\klcp_update_task.xml'
-    condition: ( all of selection1* or all of selection2* ) and not 1 of filter*
+    condition: ( all of selection_1_* or all of selection_2_* ) and not 1 of filter_optional_*
 falsepositives:
     - Benign scheduled tasks creations or executions that happen often during software installations
     - Software that uses the AppData folder and scheduled tasks to update the software in the AppData folders