Project Obsidian: Cyber Threat Hunting - Hunting for Adversary Scheduled Tasks & Persistence
Project Obsidian details hunting for malicious scheduled tasks, cron jobs, and stealthy persistence mechanisms across enterprise endpoints.
Summary
This Project Obsidian threat hunting workshop provides an extensive, hands-on methodology for detecting adversary persistence on Windows systems by hunting for malicious scheduled tasks.
[09:03] The instructor explains how to formulate structured threat hunting hypotheses based on real-world adversary tradecraft documented in threat intelligence reports, using campaigns by advanced persistent threat groups (such as Hafnium [18:48]) as practical case studies.
[29:03] The session guides participants through querying endpoint telemetry, Windows Event Logs (Event IDs 4698, 4700, and 4702), and sysmon logs to detect anomalies. The instructor demonstrates identifying suspicious parent-child process hierarchies [39:19]—such as PowerShell executing cmd.exe or schtasks.exe to register hidden tasks—auditing scheduled task XML configuration files on disk, and inspecting registry keys (HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache) to uncover stealthy persistence mechanisms that evade basic autorun scanners.
(AI summary — Gemini Flash)
Related talks
Blue Team Village·17 min
Saurabh Chaudhary
Saurabh Chaudhary demonstrates crafting high-performance, modular YARA rules to detect complex malware variants and streamline threat hunting.
Blue Team Village·1 hr
Connor Morley
Connor Morley analyzes Windows in-memory injection techniques—including process hollowing and thread hijacking—and how defenders detect them.
Blue Team Village·36 min
Defenders explore unconventional log analysis techniques, correlating seemingly unrelated telemetry sources to uncover stealthy enterprise intrusions.