Signed process creates a scheduled task via file access

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
Detector Tags	Scheduled tasks Analytics
ATT&CK Tactic	Execution (TA0002), Persistence (TA0003)
ATT&CK Technique	Scheduled Task/Job (T1053)
Severity	Informational

Description

A signed process created a scheduled task via file access. Attackers may create scheduled tasks for execution and to establish persistence.

Attacker's Goals

An attacker may gain persistence and execute malicious tools via scheduled tasks.

Investigative actions

Check the created task file and look for the action triggered by the task.

Variations

Signed process running from an untrusted directory creates a scheduled task via file access

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002), Persistence (TA0003)
ATT&CK Technique	Scheduled Task/Job (T1053)
Severity	Low

Description

A signed process created a scheduled task via file access. Attackers may create scheduled tasks for execution and to establish persistence.

Attacker's Goals

An attacker may gain persistence and execute malicious tools via scheduled tasks.

Investigative actions

Check the created task file and look for the action triggered by the task.