Back to Top
Scheduled Task Abuse Incident with Healthcare End Client on April 2, 2024
Topline Takeaways
- Industry target: Healthcare
- Attacker information:
- Scheduled task “Firefox as the Default Browser Agent”
- “Chase_Bank_Statement_March[.]zip”
- Impacted partner systems:
- Threat assessment for partners:
- The APG predicts that it is almost certainly that threat actors will continue to use Scheduled Task Abuse to exploit other healthcare organizations over the next 12 months.
- Recommended remediations and mitigations:
- Improve endpoint, asset, and network visibility
- Use a content proxy
- Scripting language controls
Scheduled Task “Firefox as the Default Browser Agent” Incident Timeline for April 2, 2024
- 3:32 p.m. ET: Blackpoint’s MDR alerted to a process violation of a JavaScript file via wscript.exe through a Scheduled Task, taking place on a healthcare end client’s endpoint.
- 4:38 p.m. ET: An MDR analyst began initial triage and investigation, as the endpoint’s Scheduled Tasks executed a new task called “FireFox as the Default Browser Agent” to run malicious files while the attacker abused the infected endpoint’s PowerShell feature to connect with a C2 server with a Dutch IP address.
- 4:39 p.m. ET: The analyst isolated the impacted endpoint from all external and internal communications.
- 4:50 p.m. ET: The SOC made contact with the healthcare end client’s MSP about the incident, and offered additional remediation advice.
More About Scheduled Task Abuse
The Scheduled Tasks function on Microsoft endpoints allow users – often developers and system administrators – to automatically perform routine tasks on a chosen device (11).
The Task Scheduler application in Windows OS allows the user to choose when a task is executed. These automation triggers can include a specific time, when an action occurs, or when a user logs in.
Scheduled tasks are not frequently used by most users of Microsoft Windows OS, as it requires a user to access their machine’s control panel and administrative tools to schedule and run the needed script and functionality.
Many organizations managing Windows OS endpoints will keep the Task Scheduler available to end users – even when they don’t know or use the functionality! – for the convenience of their more technical users and system admins.
However, threat actors are more technical than the average Windows user, and are more than capable of both accessing and running malicious tasks through a compromised endpoint’s Task Scheduler without a user knowing something is wrong.
APG Threat Analysis of Scheduled Task Abuse for 2024
The APG predicts that threat actors will almost certainly continue to abuse scheduled tasks over the next 12 months.
We base this assessment on the sheer volume of recorded and observed incidents – both within Blackpoint partner environments and in other researchers’ findings – in which scheduled tasks used by threat actors of all kinds, including advanced persistent threat (APT) and cybercriminal groups.
Threat actors seem to run scheduled tasks specifically to establish persistence on a compromised endpoint. Task Scheduler allows threat actors to automatically run malware in a way that blends into the environment, since many legitimate and allowlisted Windows applications also use scheduled tasks for automated deployments.
In 2022, for example, Microsoft security researchers observed the threat group HAFNIUM (also known as “Silk Typhoon” and “Red Dev 13”) using the Tarrask malware to create and remove “hidden” scheduled tasks defense evasion during cyberattacks (12).
Threat actors will even go so far as to name their scheduled tasks the names of common, allowlisted applications or processes – “Firefox”, for this specific incident – in order to blend in with normal endpoint activities and further evade detection.
On last week’s SOC incident analysis, the SOC thwarted a Gootloader malware incident, during which MDR analysts observed the use of a similar malicious attachment name (“chase_statement_Jan_2024[.]zip”) and a similar scheduled task name (“Firefox Default Browser Agent”) to this week’s incident.
While this week’s specific incident is not confirmed to be a prelude to a Gootloader installation, the APG believes it is likely that these scheduled tasks and malicious attachment names are related to last week’s Gootloader incident, at the very least.
Recommended Scheduled Task Abuse Mitigations and Remediations
The APG recommends the following actions to help mitigate malicious use of scheduled tasks on Windows OS devices and systems.
- Improve endpoint, asset, and overall environment visibility to monitor remote systems and endpoints.
- Active monitoring of on-device management clients can aid in detecting and isolating malicious activity conducted by Gootloader and other malware on managed endpoints.
- Implement behavioral monitoring to detect unusual patterns that could indicate malicious behavior by threat actors.
- As we’ve covered previously, threat actors abuse allowlisted applications and processes to spread malware and evade detection by more traditional security tools operating primarily from known IoCs. Heuristics-based alerting allows security teams to detect even brand-new malware or abuses… even if it’s a slightly different file name than has been previously seen, as our SOC analysts alerted to the new malicious file that was almost-but-not-quite a copy of last week’s.
- Eliminate scripting language use within your managed environment – or at the very least, implement very strong controls on its use!
- Most end users have no reason to access scripting applications such as Task Scheduler, or to run Javascript files on their endpoints. Cut off one of an attacker’s main persistence tools by severely limiting your end users’ access to these tools!
- Use a content proxy to monitor internet use and restrict user access to suspicious or risky websites.
- The malicious files seen in these incidents appear on the surface to be safe, particularly with known-good sources such as “Chase” or “Firefox Default” in the file name. The average end user – or even a rushed IT professional! – might authorize a malware script to load and deploy, thinking it’s okay. However, content proxies can help mitigate this simple human error, as it examines the source and location of the file – not the easily changed file name – to determine if the file truly is legitimate… or another Gootloader malware in disguise.
