Ghost Scheduled Task: scheduled task for both persistence and lateral movement

Ghost Scheduled Task

While using scheduled tasks as a means of persistence is not a novel approach, threat actors have employed various techniques to conceal their malicious tasks. A notable method involves removing the SD registry key, which represents the security descriptor, thereby obscuring the scheduled task from forensic investigations.

Inspired by WithSecure‘s research on Scheduled Task Tampering, they explained the feasibility of creating a scheduled task solely through registry key manipulation. Such an approach can bypass the generation of scheduled task creation event logs, like 4698 and 106, offering a more stealthy method of establishing persistence. In light of these insights, I’ve crafted this POC to demonstrate creating scheduled tasks via direct registry manipulation.

Given the undocumented nature of the registry key data structures related to scheduled tasks, my methodology for crafting them primarily relied on trial and error by comparing them with legitimate scheduled tasks. I also made references to the interfaces within Taskschd.h and drew extensively from Cyber.WTF Windows Registry Analysis – Today’s Episode: Tasks. This research was invaluable in guiding me to formulate the data structures for key registry components, such as Triggers, Actions, and DynamicInfo, which were essential to construct a functional scheduled task.

The tool offers the following features:

• Creates scheduled tasks with a restrictive security descriptor, making them invisible to all users.
• Establishes scheduled tasks directly via the registry, bypassing the generation of standard Windows event logs.
• Provides support to modify existing scheduled tasks without generating Windows event logs.
• Supports remote scheduled task creation (by using specially crafted Silver Ticket).
• Supports to run in C2 with in-memory PE execution module (e.g., BruteRatel’s memexec)

Use

Usage: GhostTask.exe <hostname/localhost> <operation> <taskname> <program> <argument> <username> <scheduletype> <time/second> <day>

- hostname/localhost: Remote computer name or "localhost".

- operation: add/delete

  - add: Create or modify a scheduled task using only registry keys. Requires restarting the "Schedule" service to load the task definition.

  - delete: Delete a scheduled task. Requires restarting the "Schedule" service to offload the task.

- taskname: Name of the scheduled task.

- program: Program to be executed.

- argument: Arguments for the program.

- username: User account under which the scheduled task will run.

- scheduletype: Supported triggers: second, daily, weekly, and logon.

- time/second (applicable for 'second', 'daily', and 'weekly' triggers):

  - For 'second' trigger: Specify the frequency in seconds for task execution.

  - For 'daily' and 'weekly' triggers: Specify the exact time (e.g., 22:30) for task execution.

- day (applicable for 'weekly' trigger): Days to execute the scheduled task (e.g., monday, thursday).

Examples

1. Create a new scheduled task that will call notepad.exe every Monday and Thursday at 2:12 p.m.:

GhostTask.exe localhost add demo “cmd.exe” “/c notepad.exe” LAB\Administrator weekly 14:12 monday,thursday

2. Modify existing scheduled task with new schedule type, user, and program:

GhostTask.exe localhost add “Microsoft\Office\Office Automatic Updates 2.0” “cmd.exe” “/c notepad.exe” LAB\employee001 daily 20:37

3. Create a new scheduled task on a remote computer:

As discussed in the WithSecure blog (Extra: Lateral Movement section), you can use specially crafted Silver Ticket to modify registry keys associated to scheduled tasks on . This allows you to create a scheduled task remotely.

Create a new scheduled task on the DC01 server remotely, which will launch notepad.exe every day at 3:19 pm:

GhostTask.exe DC01.lab.corp add demo “cmd.exe” “/c notepad.exe” LAB\Administrator daily 15:19

Download

Copyright (c) 2023 Chris Au