Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters.

Download CSV Show ATT&CK heatmap
  • An uncommon lolbin execution by scheduled task Informational 2 variations

    A lolbin was executed with uncommon commandline by a scheduled task.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Scheduled Task/Job (T1053)
    Required data: XDR Agent
    Detector tags: Scheduled tasks Analytics
    Attacker's goals: Attackers may attempt to gain persistence, privilege escalation or proxy execution on the endpoint using scheduled tasks.
    Investigative actions: Review the lolbin's command line executed by the schedule task. Investigate the specific scheduled task execution chain. Investigate how the scheduled task was created and the actor who created it.

    Variations

    An uncommon lolbin execution by scheduled task on a sensitive server

    Informational overridden

    A lolbin was executed with uncommon commandline by a scheduled task. overridden

    A rare and commonly-abused lolbin execution by scheduled task

    Informational overridden

    A commonly abused lolbin was executed with uncommon commandline by a scheduled task. overridden