T1053 Scheduled Task/Job — Detection Rules

Source-backed rule directory

• Remote Schedule Task Lateral Movement via ATSvc · test · high · {"product":"rpc_firewall","category":"application","definition":"Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:1ff70682-0a51-30e8-076d-740be8cee98b\""}
• Remote Schedule Task Lateral Movement via ITaskSchedulerService · test · high · {"product":"rpc_firewall","category":"application","definition":"Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:86d35949-83c9-4044-b424-db363231fd0c\""}
• Remote Schedule Task Lateral Movement via SASec · test · high · {"product":"rpc_firewall","category":"application","definition":"Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:378e52b0-c0a9-11cf-822d-00aa0051e40f\""}
• Cisco Modify Configuration · test · medium · {"product":"cisco","service":"aaa"}
• Suspicious Scheduled Task Write to System32 Tasks · test · high · {"product":"windows","category":"file_event"}
• HackTool - CrackMapExec Execution · test · high · {"category":"process_creation","product":"windows"}
• HackTool - CrackMapExec Execution Patterns · stable · high · {"category":"process_creation","product":"windows"}
• HackTool - SharPersist Execution · test · high · {"category":"process_creation","product":"windows"}
• Scheduled TaskCache Change by Uncommon Program · test · high · {"category":"registry_set","product":"windows"}

Atlas deterministic concepts

T1053 Scheduled Task/Job

MATCH(task_created_or_modified) AND task_action NOT_IN approved_task_actions -> ALERT

• Scheduled Task and Job Logs
• Windows Task Scheduler Logs
• Atlas source section

T1053 Scheduled Task/Job

MATCH(task_created_or_modified) AND creator NOT_IN approved_schedulers -> ALERT

• Scheduled Task and Job Logs
• Windows Task Scheduler Logs
• Linux Service-Manager Logs
• Atlas source section

Anomaly models

ATT&CK analytic guidance

DET0094 Cross-Platform Behavioral Detection of Scheduled Task/Job Abuse

AN0258 Analytic 0258

Detects creation or modification of scheduled tasks using schtasks.exe, at.exe, or COM objects followed by execution of outlier processes tied to the scheduled job.

AN0259 Analytic 0259

Detects creation or modification of cron jobs via crontab, /etc/cron.* directories, or systemd timer units with execution by unusual users or non-standard intervals.

AN0260 Analytic 0260

Detects creation or alteration of LaunchAgents or LaunchDaemons with corresponding plist modification followed by execution of associated binaries.

AN0261 Analytic 0261

Detects unusual use of `cron` or `sleep` loops inside containers executing unfamiliar scripts or binaries repeatedly.

AN0262 Analytic 0262

Detects modification of ESXi cron jobs, local.sh scripts, or scheduled API calls to persist custom binaries or shell scripts.