The VMware Carbon Black Tech Zone is live! Checkout this great resource: Mastering Carbon Black Audit & Remediation.

Bad Rabbit Scheduled Tasks

Description: Bad Rabbit Scheduled Tasks

What The Data Shows: Provides IOC for BadRabbit

SQL: 

SELECT name,action,path,enabled,state,hidden,
    datetime(last_run_time,"unixepoch","localtime") AS last_run_time,
    datetime(next_run_time,"unixepoch","localtime") AS next_run_time,
    last_run_message,last_run_code
FROM (`scheduled_tasks` )
WHERE (`name` = 'drogon') or (`name` = 'Rhaegel');
3 Comments
jnelson
Carbon Black Employee
Status changed to: Under Review

@ksnihur would you please consider converting the time stamps from the table? Maybe something like this:

SELECT name,action,path,enabled,state,hidden,
    datetime(last_run_time,"unixepoch","localtime") AS last_run_time,
    datetime(next_run_time,"unixepoch","localtime") AS next_run_time,
    last_run_message,last_run_code
FROM (`scheduled_tasks` )
WHERE (`name` = 'drogon') or (`name` = 'Rhaegel');

ksnihur
Contributor II

hey @jnelson 

Updated as requested. I'll start doing that on all the new ones I submit. 

 

jnelson
Carbon Black Employee
Status changed to: Approved

@ksnihur Thanks on both counts!!