Analytics BIOC Low
✕

Uncommon AT task-job creation by user

An unpopular AT task-job was created by a user.

Module:
Platform Analytics
Data source:
XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Scheduled Task/Job: At (T1053.002)
Attacker's goals:

Attackers may use at task-jobs for persistence or executing malicious files.

Investigative actions:

Check the AT job task for suspicious activity.

Test period:
N/A (single event)
Deduplication:
1 Day
2 variations:
  • Uncommon AT task-job creation by user from a web server process Medium (parent: Low)
  • Uncommon AT task-job creation by user from unpopular process Low