Uncommon PowerShell commands used to create or alter scheduled task parameters

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Scheduled Task/Job: Scheduled Task (T1053.005)
Severity	Low

Description

Attackers may create or alter scheduled task parameters to gain higher privileges or persistence on the system.

Attacker's Goals

Create a new scheduled task or alter an existing one to gain persistence in the system or to gain higher privileges.

Investigative actions

• Examine the PowerShell command to identify suspicious scheduled task creation or modification.
• Inspect the system for suspicious activity that is triggered by a scheduled task.