Analytics BIOC Informational
✕

Signed process creates a scheduled task via file access

A signed process created a scheduled task via file access. Attackers may create scheduled tasks for execution and to establish persistence.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Execution (TA0002) Persistence (TA0003)
ATT&CK techniques: Scheduled Task/Job (T1053)
Detector tags: Scheduled tasks Analytics
Attacker's goals:

An attacker may gain persistence and execute malicious tools via scheduled tasks.

Investigative actions:

Check the created task file and look for the action triggered by the task.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • Signed process running from an untrusted directory creates a scheduled task via file access Low (parent: Informational)