Detect New Scheduled Task Entry Creations

This hunting query identifies new scheduled task entry creations. Malware often creates scheduled tasks to execute malicious code and maintain persistence on a system.

Detection logic

Detection requirements

Platform: Containers ESXi Linux macOS Network Devices Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source product: ciscosecureendpoint crowdstrikefalconendpointprotection microsoftthreatprotection sentinelone trendmicroapexone trendmicroapexoneama vmwarecarbonblack
Log source service: carbonblackevents_cl ciscosecureendpoint_cl commonsecuritylog securityalert sentinelone_cl tmapexoneevent

Detection rules

Detect New Scheduled Task Entry Creations

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules