Task scheduled by commonly abused host process
Attackers will often attempt to abuse shell/host processes to create a persistent payload in the form of a scheduled task. Check for malicious use.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Persistence
- Status:
- Enabled
Process action type = execution AND target process name = schtasks.exe , at.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Process initiated by = cscript.exe , wscript.exe , cmd.exe , powershell.exe , mshta.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , regasm.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe , cgo name = cscript.exe , wscript.exe , cmd.exe , powershell.exe , mshta.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , regasm.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe Host host os = windows
Preventable: yes