Uncommon remote scheduled task creation

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
Detector Tags	Scheduled tasks Analytics
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	Scheduled Task/Job (T1053)
Severity	Low

Description

The schtasks.exe command enables creating, deleting, querying, changing, running, and ending scheduled tasks on a local or remote computer. Adversaries may attempt to use the command to execute programs or persist malware on remote machines.

Attacker's Goals

Attackers can attempt to use the command to execute programs or persist malware on remote endpoints.

Investigative actions

• Investigate the initiator process and whether it should create remote tasks.
• Investigate the scheduled task execution on the remote machine.

Variations

Uncommon remote scheduled task creation by a remote actor via RDP

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	Scheduled Task/Job (T1053)
Severity	High

Description

The schtasks.exe command enables creating, deleting, querying, changing, running, and ending scheduled tasks on a local or remote computer. Adversaries may attempt to use the command to execute programs or persist malware on remote machines.

Attacker's Goals

Attackers can attempt to use the command to execute programs or persist malware on remote endpoints.

Investigative actions

• Investigate the initiator process and whether it should create remote tasks.
• Investigate the scheduled task execution on the remote machine.