Scheduled Task/Job

Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.

• Audit scheduled tasks regularly
• Restrict task creation permissions
• Monitor for unusual scheduled tasks

• Monitor scheduled task creation
• Track schtasks.exe and at.exe usage
• Alert on tasks with suspicious commands