Hello again.
This clip will look at OSSEC and its capability to
detect Scheduled Task Creation,
which adversaries often used as a persistence mechanism.
When we look at the MITRE ATT&CK framework,
Scheduled Task/Job is listed as a technique under the Persistence tactic.
The sub technique Scheduled Task refers to the malicious use of
the Windows Task Scheduler by cyber adversaries.
We have looked at MITRE Shield in previous clips where we
covered active defense tactics for account creation and
accessibility feature abuse.
We will now look at an active defense tactic for
malicious use of scheduled tasks.
Here,
the guidance provided by MITRE Shield is to generate
alerts from our logs when new scheduled tasks are created
or an existing task is modified.
The previous techniques I covered are all detected
out of the box by OSSEC; however,
there is no default for Scheduled Task Creation,
so we must get our hands dirty. What you see on the screen
is a custom rule I created that tells OSSEC to alert when a
scheduled task is created.
Now, I'm not going to deep dive into rule creation,
but I will briefly discuss some components.
First, the rule id numbers above 100,000 are reserved for custom rules,
rules are read from the highest level to the lowest level,
a rule that has a level set to 0 is effectively disabled,
there are currently 16 levels, and they're not all in use.
I arbitrarily chose level 7,
but you have to assess the levels and determine what
makes sense for your organization.
I've included a link to the rule classification levels on the screen.
Next,
we have the Windows event id 4698 that is generated for scheduled tasks created.
The last component I'll cover is optional, but I strongly recommend it.
We can enrich rules to include the MITRE tactic number and
any other descriptive details to help anyone who maintains
this and any other rules we create.
Another use case is to identify dependencies.
Scheduled Task Creation is not logged by default on Windows workstations.
So I've included a note to change the Audit Policy. In the upcoming demo,
we'll take a closer look at the exact audit policy that needs to be configured.