Automated tasks that can be executed at a specific time or on a recurring schedule running in the background (ex: Cron daemon, task scheduler, BITS)[1]
Initial construction of a new scheduled job (ex: Windows EID 4698 or /var/log cron logs)
Initial construction of a new scheduled job (ex: Windows EID 4698 or /var/log cron logs)
| Domain | ID | Name | |
|---|---|---|---|
| Enterprise | T1053 | Scheduled Task/Job | |
| .001 | At (Linux) | ||
| .002 | At (Windows) | ||
| .003 | Cron | ||
| .005 | Scheduled Task | ||
| .006 | Systemd Timers | ||
| .007 | Container Orchestration Job | ||
Contextual data about a scheduled job, which may include information such as name, timing, command(s), etc.
Contextual data about a scheduled job, which may include information such as name, timing, command(s), etc.
| Domain | ID | Name | |
|---|---|---|---|
| Enterprise | T1036 | Masquerading | |
| .004 | Masquerade Task or Service | ||
Changes made to a scheduled job, such as modifications to the execution launch (ex: Windows EID 4702 or /var/log cron logs)
Changes made to a scheduled job, such as modifications to the execution launch (ex: Windows EID 4702 or /var/log cron logs)
| Domain | ID | Name | |
|---|---|---|---|
| Enterprise | T1036 | Masquerading | |
| .004 | Masquerade Task or Service | ||