Hunts suspicious Windows scheduled tasks for attacker persistence (T1053.005) by analyzing creation events, task properties, and execution patterns. For threat hunting in Windows environments with Sysmon, Splunk, or Sentinel.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
- 主动狩猎 Windows 环境中的持久化机制时
Hunts adversary persistence (T1053.005) in Windows scheduled tasks via event analysis (4698/4699), Sysmon, PowerShell enumeration, and Splunk queries for suspicious creations/executions.
Hunts for adversary persistence via Windows scheduled tasks (T1053.005) by analyzing Event ID 4698/4699, suspicious properties, triggers, and execution patterns in Sysmon/Splunk logs.
Hunts attacker persistence via Windows scheduled tasks by analyzing creation events, suspicious operations, and abnormal scheduling patterns. Useful for threat hunting, incident response, and security assessments.
Share bugs, ideas, or general feedback.
schtasks /query /fo CSV /v 或 Get-ScheduledTask PowerShell cmdlet 收集目标系统的完整任务清单。index=wineventlog EventCode=4698
| spath output=TaskName path=EventData.TaskName
| spath output=TaskContent path=EventData.TaskContent
| where NOT match(TaskName, "(?i)(\\\\Microsoft\\\\|\\\\Windows\\\\)")
| table _time Computer SubjectUserName TaskName TaskContent
index=sysmon EventCode=1 Image="*\\schtasks.exe"
| where match(CommandLine, "(?i)/create")
| where match(CommandLine, "(?i)(powershell|cmd|wscript|cscript|mshta|rundll32|regsvr32|http|https|\\\\temp\\\\|\\\\appdata\\\\)")
| table _time Computer User CommandLine ParentImage
SecurityEvent
| where EventID == 4698
| extend TaskName = tostring(EventData.TaskName)
| extend TaskContent = tostring(EventData.TaskContent)
| where TaskContent has_any ("powershell", "cmd.exe", "wscript", "http://", "https://", "\\Temp\\", "\\AppData\\")
| project TimeGenerated, Computer, Account, TaskName, TaskContent
schtasks /create /s REMOTE_HOST 远程创建计划任务在其他系统上执行。狩猎 ID：TH-SCHTASK-[日期]-[序号]
主机：[主机名]
任务名称：[完整任务路径]
操作：[执行的命令/脚本]
触发器：[启动/登录/定时器/事件]
创建者：[用户账户]
创建来源：[本地/远程]
创建时间：[时间戳]
运行账户：[执行账户]
风险等级：[严重/高/中/低]