Analytics BIOC
Informational
✕
Uncommon signed process execution by scheduled task
An uncommon process was executed by a scheduled task.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Scheduled Task/Job (T1053)
Detector tags: Scheduled tasks Analytics
Attacker's goals:
Attackers may attempt to gain persistence, privilege escalation or proxy execution on the endpoint using scheduled tasks.
Investigative actions:
Review the process executed by the schedule task. Investigate the specific scheduled task execution chain. Check if the vendor is known in the organization for creating scheduled tasks to execute his product.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
3 variations:
- Uncommon Microsoft signed process execution by scheduled task Informational
- Uncommon signed process execution by scheduled task on a sensitive server Low (parent: Informational)
- Rare signed process execution by scheduled task Low (parent: Informational)