Analytics BIOC
Informational
✕
An uncommon lolbin execution by scheduled task
A lolbin was executed with uncommon commandline by a scheduled task.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Scheduled Task/Job (T1053)
Detector tags: Scheduled tasks Analytics
Attacker's goals:
Attackers may attempt to gain persistence, privilege escalation or proxy execution on the endpoint using scheduled tasks.
Investigative actions:
Review the lolbin's command line executed by the schedule task. Investigate the specific scheduled task execution chain. Investigate how the scheduled task was created and the actor who created it.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
2 variations:
- An uncommon lolbin execution by scheduled task on a sensitive server Informational
- A rare and commonly-abused lolbin execution by scheduled task Informational