This alert Detects when adversaries try to stop system services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities
Critical
Alert Rule
title: Deleted Windows Important Scheduled Task Deleted
author: Admin
description: The Detects when adversaries try to stop system services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities.
detection:
condition: selection and not filter
filter:
UserName|contains:
- AUTHORI
- AUTORI
selection:
EventID: 141
TaskName|contains:
- \Windows\SystemRestore\SR
- \Windows\Windows Defender\
- \Windows\BitLocker
- \Windows\WindowsBackup\
- \Windows\WindowsUpdate\
- \Windows\UpdateOrchestrator\
- \Windows\ExploitGuard
level: Critical
product: windows
service: taskscheduler
logtype: windows
Alert Data
agent.type : wineventlog
event.action : Task registration deleted
event.channel : taskscheduler
event.code : 141
event.dataset : taskscheduler
event.module : windows
event.provider : Microsoft-Windows-TaskScheduler
host.name : BHC000112
log.type : windows
observer.product : windows
observer.vendor: microsoft
related.domains : NT AUTHORITY
user.name : SYSTEM
winlog.computer_name : BHC000112.test.LOCAL
winlog.event_data.taskname : \Microsoft\Windows\UpdateOrchestrator\AC Power Install
winlog.event_id : 141
winlog.process.pid : 1356
winlog.provider_name : Microsoft-Windows-TaskScheduler
winlog.task : Task registration deleted
winlog.user.domain : NT AUTHORITY
Provide a Dismiss Comment
Dismissed Reason:
A User Cleared Security Eventlog.
Category: Security
This alert indicates that One of the Windows Eventlogs has been cleared.
High
Alert Rule
title: Security Eventlog Cleared
author: Admin
description: One of the Windows Eventlogs has been cleared.
detection:
condition: 1 of selection_*
selection_1102:
EventID: 1102
Provider_Name: Microsoft-Windows-Eventlog
selection_517:
EventID: 517
Provider_Name: Security
level: high
logsource:
product: windows
service: security
logtype: windows
New or Renamed User Account with $ in Attribute SamAccountName.
Category: Security
This alert Detects possible bypass EDR and SIEM via abnormal user account name.
Medium
Alert Rule
title: New or Renamed User Account with '$' in Attribute 'SamAccountName'
author: Admin
description: This Alert indicates Detects possible bypass EDR and SIEM via abnormal user account name.
detection:
condition: 1 of selection*
selection1:
EventID: 4720
SamAccountName|contains: $
selection2:
EventID: 4781
NewTargetUserName|contains: $
level: Medium
logsource:
product: windows
service: security
logtype: windows
Provide a Dismiss Comment