Ghost Scheduled Task: scheduled task for both persistence and lateral movement
Ghost Scheduled Task
While using scheduled tasks as a means of persistence is not a novel approach, threat actors have employed various techniques to conceal their malicious tasks. A notable method involves removing the SD registry key, which represents the security descriptor, thereby obscuring the scheduled task from forensic investigations.
Inspired by WithSecure‘s research on Scheduled Task Tampering, they explained the feasibility of creating a scheduled task solely through registry key manipulation. Such an approach can bypass the generation of scheduled task creation event logs, like 4698 and 106, offering a more stealthy method of establishing persistence. In light of these insights, I’ve crafted this POC to demonstrate creating scheduled tasks via direct registry manipulation.
Given the undocumented nature of the registry key data structures related to scheduled tasks, my methodology for crafting them primarily relied on trial and error by comparing them with legitimate scheduled tasks. I also made references to the interfaces within Taskschd.h and drew extensively from Cyber.WTF Windows Registry Analysis – Today’s Episode: Tasks. This research was invaluable in guiding me to formulate the data structures for key registry components, such as Triggers, Actions, and DynamicInfo, which were essential to construct a functional scheduled task.
The tool offers the following features:
- Creates scheduled tasks with a restrictive security descriptor, making them invisible to all users.
- Establishes scheduled tasks directly via the registry, bypassing the generation of standard Windows event logs.
- Provides support to modify existing scheduled tasks without generating Windows event logs.
- Supports remote scheduled task creation (by using specially crafted Silver Ticket).
- Supports to run in C2 with in-memory PE execution module (e.g., BruteRatel’s memexec)
1. Create a new scheduled task that will call notepad.exe every Monday and Thursday at 2:12 p.m.:
GhostTask.exe localhost add demo “cmd.exe” “/c notepad.exe” LAB\Administrator weekly 14:12 monday,thursday
2. Modify existing scheduled task with new schedule type, user, and program:
GhostTask.exe localhost add “Microsoft\Office\Office Automatic Updates 2.0” “cmd.exe” “/c notepad.exe” LAB\employee001 daily 20:37
3. Create a new scheduled task on a remote computer:
As discussed in the WithSecure blog (Extra: Lateral Movement section), you can use specially crafted Silver Ticket to modify registry keys associated to scheduled tasks on . This allows you to create a scheduled task remotely.
Create a new scheduled task on the DC01 server remotely, which will launch notepad.exe every day at 3:19 pm:
GhostTask.exe DC01.lab.corp add demo “cmd.exe” “/c notepad.exe” LAB\Administrator daily 15:19
Copyright (c) 2023 Chris Au