Tag
medium
advisory
Detection of Rapid Creation and Deletion of Windows Scheduled Tasks
1 rule 2 TTPsAdversaries abuse the Windows Task Scheduler to execute malicious code and maintain persistence by creating and rapidly deleting tasks to obfuscate their footprint.
Windows
persistence
execution
task-scheduler
1r
2t
high
advisory
Suspicious Command Patterns in Scheduled Task Creation
1 rule 1 TTPAdversaries frequently leverage scheduled tasks to maintain persistence or execute malicious payloads by invoking commands from temporary directories or utilizing obfuscated PowerShell/scripting patterns.
persistence
privilege-escalation
execution
windows
task-scheduler
1r
1t