Diamond Sleet APT Scheduled Task Creation via TeamCity Exploit

SigmaHQ Detections@sigmaHQ

•updated Sep 2, 2024•0•20

Detects the creation of a scheduled task named '\Windows TeamCity Settings User Interface' with a specific content string 'uTYNkfKxHiZrx3KJ'. This activity has been linked to the Diamond Sleet APT group exploiting the TeamCity CVE-2023-42793 vulnerability for execution, persistence, and privilege escalation.