Synopsis
Activation Period |
14 Days |
Training Period |
30 Days |
Test Period |
N/A (single event) |
Deduplication Period |
1 Day |
Required Data |
|
Detection Modules |
|
Detector Tags |
|
ATT&CK Tactic |
|
ATT&CK Technique |
|
Severity |
Informational |
Description
An uncommon process was executed by a scheduled task.
Attacker's Goals
Attackers may attempt to gain persistence, privilege escalation or proxy execution on the endpoint using scheduled tasks.
Investigative actions
- Review the process executed by the schedule task.
- Investigate the specific scheduled task execution chain.
- Check if the vendor is known in the organization for creating scheduled tasks to execute his product.
Variations
Uncommon Microsoft signed process execution by scheduled taskUncommon signed process execution by scheduled task on a sensitive server
Rare signed process execution by scheduled task