Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
An attacker with valid credentials and privileges can schedule a task on a remote machine to run programs and set up a persistent attack campaign. However, the time-consuming process of acquiring credentials and the risk of detection lowers the likelihood of this technique. If the attacker is able to remotely schedule tasks, a persistent threat is established that could have a significant impact on a business or organization.
The system might change the risk score for this detection.
Kill Chain
Risk Score
61
Several types of operating systems include a scheduled task feature, which enables users to specify a time to run a script or program. Scheduled tasks can be registered on a device locally or remotely through Microsoft remote procedure call (MS-RPC) operations. First, an attacker must gain access to a target device with a valid set of credentials and local admin privileges (1). Then, the attacker sends an MS-RPC request with an operation for the task scheduler to register the scheduled tasks. The operation includes commands that run during specific times (2). For example, the attacker can schedule commands to run during a system startup, or schedule the delivery of periodic short messages, known as beacons, to a command-and-control server. Over time, an attacker can establish a persistent presence on the network, which could lead to other malicious purposes, such as exfiltrating data or cryptocurrency mining (3).
Configure scheduled task settings to make sure tasks run with least privilege
Restrict administrator privileges in your environment
