このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
What happened
A scheduled task was created, potentially to establish persistence.
Goal
Detect the creation of scheduled tasks.
Strategy
This rule generates a signal when a scheduled task is created. Threat actors often use scheduled tasks as a persistence mechanism.
Triage and response
- Identify what the scheduled task is executing and determine if it’s authorized.
- If it’s not authorized, isolate the host from the network.
- Follow your organization’s internal processes for investigating and remediating compromised systems.
Requires Agent version 7.50.0 or greater.
