Scheduled task created with HTTP or FTP reference

BIOC Low

Scheduled task created with HTTP or FTP reference

Scheduled tasks don't normally include web URLs and may indicate malware activity.

Module:: Platform Analytics
Agent event type:: Process execution
Category:: Execution
Status:: Enabled

ATT&CK tactics: Execution (TA0002)

ATT&CK techniques: Scheduled Task/Job (T1053)

Indicator:

Process action type = execution AND target process name = schtasks.exe , at.exe AND target process cmd = *http://* , *https://* , *ftp://* AND target process cmd != *SmartDraw*

Preventable: yes