Analytics BIOC
Low
✕
Rare Scheduled Task RPC activity from a rarely seen host
The endpoint performed abnormal Scheduled Task RPC activity to a remote host.
- Module:
- Platform Analytics
- Data source:
- Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Lateral Movement (TA0008) Persistence (TA0003)
ATT&CK techniques: Remote Services (T1021) Scheduled Task/Job (T1053)
Detector tags: NDR Lateral Movement Analytics NDR Unmanaged Subnet Analytics
Attacker's goals:
Attackers may attempt to gain persistence or move laterally over the network by executing code on remote hosts using scheduled tasks. The ITaskSchedulerService RPC interface is used to create and manage scheduled tasks on a local or remote host.
Investigative actions:
Review the action of the created scheduled task on the remote host. Correlate the RPC call from the source host and understand which software initiated it. Verify that this isn't IT activity.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day