Rare unsigned process execution by scheduled task

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2026-03-10

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent
Detection Modules
Detector Tags
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Scheduled Task/Job (T1053)
Severity	Low
Response playbooks	Variations of this detector that create incidents have an OOTB response playbook included in the Cortex Response and Remediation Pack

Rare and unsigned process was executed by a scheduled task.

Attackers may attempt to gain persistence on the endpoint using scheduled tasks.

Uncommon and unsigned process was executed by a scheduled task.

Attackers may attempt to gain persistence on the endpoint using scheduled tasks.

Rare and unsigned process was execution with high integrity level by a scheduled task.

Attackers may attempt to gain persistence on the endpoint using scheduled tasks.

ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Scheduled Task/Job (T1053)
Severity	Medium
Response playbooks	Suspicious process execution by scheduled task on a sensitive server

Rare and unsigned process was executed by a scheduled task.

Attackers may attempt to gain persistence on the endpoint using scheduled tasks.