Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters.

Download CSV Show ATT&CK heatmap
  • Rare scheduled task created Informational 4 variations

    A new rare scheduled task was created with a rare path and a rare command line.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Scheduled Task/Job (T1053)
    Required data: XDR Agent with eXtended Threat Hunting (XTH)
    Detector tags: Impacket Analytics, Scheduled tasks Analytics
    Attacker's goals: Attackers may attempt to gain persistence on the endpoint using scheduled task.
    Investigative actions: Review the action of the created scheduled task. Investigate the execution chain of the process creating the scheduled task.

    Variations

    Rare scheduled task created by an injected actor

    High overridden

    A new rare scheduled task was created by an injected actor with a rare path and a rare command line. overridden

    Uncommon remote scheduled task created

    Medium overridden

    A new uncommon remote scheduled task was created with a rare path and a rare command line. overridden

    Uncommon local scheduled task created

    Low overridden

    A new uncommon local scheduled task was created with a rare path and a rare command line. overridden

    Highly rare scheduled task created

    Low overridden

    A new rare scheduled task was created with an highly rare path and a rare command line. overridden