Diamond Sleet APT Scheduled Task Creation via Registry

SigmaHQ Detections@sigmaHQ

•updated Sep 2, 2024•0•23

Detects the creation of a scheduled task in the Windows Registry that is specifically associated with the Diamond Sleet APT group. This activity is linked to their exploitation of the TeamCity CVE-2023-42793 vulnerability, where they create a scheduled task named 'Windows TeamCity Settings User Interface' to establish persistence or execute malicious code.