T1053
Scheduled Task/Job
Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.
ATT&CK / Persistence
Defense strategies
- Audit scheduled tasks regularly
- Restrict task creation permissions
- Monitor for unusual scheduled tasks
Detection methods
- Monitor scheduled task creation
- Track schtasks.exe and at.exe usage
- Alert on tasks with suspicious commands
D3FEND mappings
1