Analytics BIOC
Low
✕
Scheduled Task hidden by registry modification
Attackers may try to hide a Scheduled Task by deleting the Scheduled Task's software descriptor (SD) value in the registry.
- Module:
- Platform Analytics
- Data source:
- XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Modify Registry (T1112) Hide Artifacts (T1564)
Attacker's goals:
Adversaries may hide their malicious Scheduled Task to evade detection.
Investigative actions:
Check the appropriate Scheduled Task to verify its legitimacy. You can also check the executing executable to verify its purpose.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day