Analytics BIOC Low
✕

Uncommon remote scheduled task creation

The schtasks.exe command enables creating, deleting, querying, changing, running, and ending scheduled tasks on a local or remote computer. Adversaries may attempt to use the command to execute programs or persist malware on remote machines.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: Scheduled Task/Job (T1053)
Detector tags: Scheduled tasks Analytics
Attacker's goals:

Attackers can attempt to use the command to execute programs or persist malware on remote endpoints.

Investigative actions:

Investigate the initiator process and whether it should create remote tasks. Investigate the scheduled task execution on the remote machine.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • Uncommon remote scheduled task creation by a remote actor via RDP High (parent: Low)