Les Miserable Persistence - Hunting Through Scheduled Tasks - ShmooCon 2023.pdf
•
0 likes•52 views
I always thought scheduled tasks fell into the category of low-level adversaries. Did you know that a standard build of Windows 10 or 11 contains about 150 scheduled tasks by default? Did you know over 40 of these tasks are hidden by default? Cue misery… In this talk, I’ll explore the various details we can extract about scheduled tasks and why it’s so difficult to find anomalies. Everything from Microsoft typos, inconsistent naming schemes, and obfuscated execution details. And don’t worry, it’s not all doom and gloom. You’ll leave this presentation with PowerShell scripts, Elasticsearch dashboards, and a better understanding on how to hunt for malicious persistence.
Recommended
Recommended
More Related Content
Similar to Les Miserable Persistence - Hunting Through Scheduled Tasks - ShmooCon 2023.pdf
Similar to Les Miserable Persistence - Hunting Through Scheduled Tasks - ShmooCon 2023.pdf (20)
More from Brandon DeVault
More from Brandon DeVault (12)
Recently uploaded
Recently uploaded (20)
Les Miserable Persistence - Hunting Through Scheduled Tasks - ShmooCon 2023.pdf
- 1. Les Misérables Persistence: Hunting Through Scheduled Tasks ShmooCon 2023 Brandon DeVault Principal Security Author, Pluralsight Defensive Cyber Operations, FL Air National Guard /in/brandon-devault @SolderSwag www.devaultsecurity.com
- 2. Agenda • Introduction & Detection • PowerShell Analysis • Dashboard Analysis with Elastic • Q&A
- 3. Persistence Techniques - MITRE Account Manipulation BITS Jobs Boot or Logon Autostart Execution Boot or Logon Initialization Scripts Browser Extensions Compromise Client Software Binary Create Account Create or Modify System Process Event Triggered Execution External Remote Services Hijack Execution Flow Implant Internal Image Modify Authentication Process Office Application Startup Pre-OS Boot Scheduled Task/Job Server Software Component Traffic Signaling Valid Accounts Boot or Logon Autostart Execution Boot or Logon Initialization Scripts Browser Extensions Compromise Client Software Binary Create Account Create or Modify System Process Event Triggered Execution External Remote Services Hijack Execution Flow Implant Internal Image Modify Authentication Process Office Application Startup Pre-OS Boot Scheduled Task/Job Server Software Component Traffic Signaling Valid Accounts
- 4. Persistence Techniques - MITRE Scheduled Task/Job T1053.002 – At T1053.003 – Cron T1053.005 – Scheduled Task T1053.006 – Systemd Timers T1053.007 – Container Orchestration Job *132 Named Threat Groups having used this persistence method
- 5. Detection Methods • Command Execution • WMI, PowerShell, cmd … • File Modification • %systemroot%Sytem32Tasks • Process Creation • Registry Key Creation • Log Detection! • Sysmon • Event ID: 4698-4702
- 10. Attempt #1
- 11. Step 1 – Export the Tasks (using PowerShell) $savefolder = "C:SomeFolder" Get-ScheduledTask | ForEach-Object { $_.TaskName Export-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath | Out-file (Join-Path $savefolder "$($_.TaskName).xml") }
- 12. Step 2 – Convert to JSON (using Python) import xmltodict, json, os directory = '/some/directory/’ for filename in os.listdir(directory): if filename.endswith(".xml"): with open(filename, 'rb') as f: XML_content = f.read() x = xmltodict.parse(XML_content) j = json.dumps(x) print (filename) filename = filename.replace('.xml', '') output_file = open(filename + '.json', 'w') output_file.write(j)
- 13. Step 3 – Import! • Fail… • Not a proper NDJSON format
- 14. Attempt #2
- 15. Convert JSON to NDJSON (using jq) cat test.json | jq -c '.[]' > testNDJSON.json
- 16. Import! • Fail… • Multi-nested complex JSON file
- 17. Attempt #3
- 18. Convert JSON to NDJSON (using Python) <Super Awesome Code>
- 19. Import! • Fail… • Still too complex
- 20. Attempt #4
- 21. Create a Logstash Pipeline • XML Parser • 30 minutes later… • Task Scheduler schema: 658 lines…
- 22. Attempt #5
- 23. Convert to CSV • Tool: SaveJson2CSV • Gunamoi Software
- 26. Questions? • www.devaultsecurity.com • linkedin. • twitter. devaultsecurity.com • github. • brandon-devault@pluralsight.com • https://app.pluralsight.com/profile/author/brandon-devault • https://github.com/Oofles/scheduled-tasks }