CmdID

CmdID / Techniques

T1053 Scheduled Task/Job

Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. MITRE ATT&CK

5 Sigma rules T1053 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK

T1053.002Scheduled Task/Job: At

T1053.003Scheduled Task/Job: Cron

T1053.005Scheduled Task/Job: Scheduled Task

Sigma rules tagged with it

process creation, the highest levels first

criticalHAFNIUM Exchange Exploitation ActivityFlorian Roth (Nextron Systems) · Windows

highHackTool - CrackMapExec ExecutionFlorian Roth (Nextron Systems) · Windows

highHackTool - CrackMapExec Execution PatternsThomas Patzke · Windows

highHackTool - SharPersist ExecutionFlorian Roth (Nextron Systems) · Windows

highPotential ACTINIUM Persistence ActivityAndreas Hunkeler (@Karneades) · Windows