Analytics BIOC
Informational
✕
Rare scheduled task created
A new rare scheduled task was created with a rare path and a rare command line.
- Module:
- Platform Analytics
- Data source:
- XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Scheduled Task/Job (T1053)
Detector tags: Impacket Analytics Scheduled tasks Analytics
Attacker's goals:
Attackers may attempt to gain persistence on the endpoint using scheduled task.
Investigative actions:
Review the action of the created scheduled task. Investigate the execution chain of the process creating the scheduled task.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
4 variations:
- Rare scheduled task created by an injected actor High (parent: Informational)
- Uncommon remote scheduled task created Medium (parent: Informational) Adds Remote Services (T1021)
- Uncommon local scheduled task created Low (parent: Informational)
- Highly rare scheduled task created Low (parent: Informational)