Rare scheduled task created

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent with eXtended Threat Hunting (XTH)
Detector Tags	Impacket Analytics, Scheduled tasks Analytics
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Scheduled Task/Job (T1053)
Severity	Informational

Description

A new rare scheduled task was created with a rare path and a rare command line.

Attacker's Goals

Attackers may attempt to gain persistence on the endpoint using scheduled task.

Investigative actions

• Review the action of the created scheduled task.
• Investigate the execution chain of the process creating the scheduled task.

Variations

Rare scheduled task created by an injected actor

Synopsis

Field	Value
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Scheduled Task/Job (T1053)
Severity	High

Description

A new rare scheduled task was created by an injected actor with a rare path and a rare command line.

Attacker's Goals

Attackers may attempt to gain persistence on the endpoint using scheduled task.

Investigative actions

• Review the action of the created scheduled task.
• Investigate the execution chain of the process creating the scheduled task.

Uncommon remote scheduled task created

Synopsis

Field	Value
ATT&CK Tactic	Persistence (TA0003), Lateral Movement (TA0008)
ATT&CK Technique	Scheduled Task/Job (T1053), Remote Services (T1021)
Severity	Medium

Description

A new uncommon remote scheduled task was created with a rare path and a rare command line.

Attacker's Goals

Attackers may attempt to gain persistence or perform lateral movement to new hosts to expand the foothold within a network.

Investigative actions

• Review the action of the created scheduled task.
• Correlate the RPC call from the source host and understand which software initiated it.

Uncommon local scheduled task created

Synopsis

Field	Value
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Scheduled Task/Job (T1053)
Severity	Low

Description

A new uncommon local scheduled task was created with a rare path and a rare command line.

Attacker's Goals

Attackers may attempt to gain persistence on the endpoint using scheduled task.

Investigative actions

• Review the action of the created scheduled task.
• Investigate the execution chain of the process creating the scheduled task.

Highly rare scheduled task created

Synopsis

Field	Value
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Scheduled Task/Job (T1053)
Severity	Low

Description

A new rare scheduled task was created with an highly rare path and a rare command line.

Attacker's Goals

Attackers may attempt to gain persistence on the endpoint using scheduled task.

Investigative actions

• Review the action of the created scheduled task.
• Investigate the execution chain of the process creating the scheduled task.