Analytics BIOC Low
✕

Rare unsigned process execution by scheduled task

Rare and unsigned process was executed by a scheduled task.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Scheduled Task/Job (T1053)
Detector tags: Scheduled tasks Analytics
Attacker's goals:

Attackers may attempt to gain persistence on the endpoint using scheduled tasks.

Investigative actions:

Review the process executed by the schedule task. Investigate the specific scheduled task execution chain.

Test period:
N/A (single event)
Deduplication:
1 Day
3 variations:
  • Uncommon unsigned process execution by scheduled task Informational (parent: Low)
  • Rare unsigned process execution with high integrity level by scheduled task Medium (parent: Low)
  • Rare unsigned process execution by scheduled task on a sensitive server Medium (parent: Low)