KONNI Scheduled Task Persistence with Obfuscated PowerShell
This rule detects the KONNI malware's persistence mechanism, which involves creating a scheduled task disguised as a OneDrive startup task. The task is configured to execute hourly and launches an obfuscated PowerShell script. The detection logic specifically looks for the creation of a scheduled task using 'schtasks.exe' with hourly execution, a command line containing 'OneDrive' and 'Startup Task', and a hidden PowerShell window. Additionally, it detects the execution phase where 'powershell.exe' is launched by 'schtasks.exe', reading a file from 'C:\ProgramData\VljE', and performing XOR decryption. A third selection identifies obfuscated PowerShell execution involving 'Invoke-Expression', text encoding, and XOR decryption. The rule triggers if either the task creation pattern is observed or if both the task execution and obfuscated execution patterns are observed.
Sigma
