Uncommon AT task-job creation by user

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules
Detector Tags
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Scheduled Task/Job: At (T1053.002)
Severity	Low

An unpopular AT task-job was created by a user.

Attackers may use at task-jobs for persistence or executing malicious files.

Check the AT job task for suspicious activity.

A web process used the AT command to create a new AT task-job.

Attackers may use at task-jobs for persistence or executing malicious files.

Check the AT job task for suspicious activity.

An unpopular process created an AT task-job on the host, which is not popular in the organization.

Attackers may use at task-jobs for persistence or executing malicious files.

Check the AT job task for suspicious activity.