Analytics BIOC Informational
✕

Rare Scheduled Task RPC activity

The endpoint performed abnormal Scheduled Task RPC activity to a remote host.

Module:
Platform Analytics
Data source:
Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Lateral Movement (TA0008) Persistence (TA0003)
ATT&CK techniques: Remote Services (T1021) Scheduled Task/Job (T1053)
Detector tags: NDR Lateral Movement Analytics
Attacker's goals:

Attackers may attempt to gain persistence or move laterally over the network by executing code on remote hosts using scheduled tasks. The ITaskSchedulerService RPC interface is used to query and manage services on a local or remote host.

Investigative actions:

Review the action of the created scheduled task on the remote host. Correlate the RPC call from the source host and understand which software initiated it.* Verify that this isn't IT activity.

Test period:
N/A (single event)
Deduplication:
1 Day
3 variations:
  • Rare remote task registration and creation via Scheduled Task RPC interface Medium (parent: Informational)
  • Rare remote task creation via Scheduled Task RPC interface Medium (parent: Informational)
  • Rare Scheduled Task RPC activity Low (parent: Informational)