ALT-2411 · Sysmon
Scheduled task created for persistence
schtasks.exe created a task running a script from a user-writable directory every 30 minutes.
mediumInvestigatingconfidence 68% · 1970-01-01 07:44:00Z · rule DET-0165 Suspicious Scheduled Task
Detection summary
schtasks.exe created a task running a script from a user-writable directory every 30 minutes.
- Affected host
- WS-FIN-014
- Affected user
- d.kusuma
- Source IP
- 10.20.4.17
- Detection rule
- DET-0165 Suspicious Scheduled Task
- Log source
- Sysmon
- Assignee
- A. Pratama
Recommended actions
- Remove the task
- Collect the script
- Hunt for the same task name estate-wide
Analyst decision
Triage checklist
- 1. Confirm the detection logic matched genuine activity.
- 2. Check user and asset context for expected behaviour.
- 3. Pivot on host, user, IP and hash in the Log Explorer.
- 4. Enrich IOCs with threat intelligence.
- 5. Set a verdict and record your reasoning.