Analytics BIOC
Low
✕
Uncommon PowerShell commands used to create or alter scheduled task parameters
Attackers may create or alter scheduled task parameters to gain higher privileges or persistence on the system.
- Module:
- Platform Analytics
- Data source:
- XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Scheduled Task/Job: Scheduled Task (T1053.005)
Attacker's goals:
Create a new scheduled task or alter an existing one to gain persistence in the system or to gain higher privileges.
Investigative actions:
Examine the PowerShell command to identify suspicious scheduled task creation or modification. Inspect the system for suspicious activity that is triggered by a scheduled task.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day