| elastic |
OpenAI ChatGPT Enterprise Custom Agent Trigger Changed |
production |
2026-10-06 |
| elastic |
Scheduled Task Execution at Scale via GPO |
production |
2026-10-06 |
| elastic |
Unusual Scheduled Task Update |
production |
2026-10-06 |
| elastic |
Persistence via a Windows Installer |
production |
2026-10-05 |
| elastic |
Temporarily Scheduled Task Creation |
production |
2026-09-21 |
| elastic |
Persistence via TelemetryController Scheduled Task Hijack |
production |
2026-09-18 |
| elastic |
Kubernetes Sensitive Configuration File Activity |
production |
2026-09-18 |
| elastic |
Kubernetes Static Pod Manifest File Access |
production |
2026-09-18 |
| elastic |
Executable Bit Set for Potential Persistence Script |
production |
2026-09-18 |
| elastic |
Systemd Timer Created |
production |
2026-09-18 |
| elastic |
Suspicious CronTab Creation or Modification |
production |
2026-09-18 |
| elastic |
Potential Persistence via Periodic Tasks |
production |
2026-09-18 |
| elastic |
Privilege Escalation via Root Crontab File Modification |
production |
2026-09-18 |
| elastic |
Potential Redis CONFIG SET Cron Directory Persistence (RedisRaider) |
production |
2026-09-18 |
| elastic |
Suspicious ScreenConnect Client Child Process |
production |
2026-09-18 |
| elastic |
Scheduled Tasks AT Command Enabled |
production |
2026-09-18 |
| elastic |
Potential PowerShell HackTool Script by Function Names |
production |
2026-09-18 |
| elastic |
Outbound Scheduled Task Activity via PowerShell |
production |
2026-09-18 |
| elastic |
Remote Scheduled Task Creation via RPC |
production |
2026-09-18 |
| elastic |
Remote Scheduled Task Creation |
production |
2026-09-18 |
| elastic |
Persistence via Scheduled Job Creation |
production |
2026-09-18 |
| elastic |
Local Scheduled Task Creation |
production |
2026-09-18 |
| elastic |
Scheduled Task Created by a Windows Script |
production |
2026-09-18 |
| elastic |
Suspicious Image Load (taskschd.dll) from MS Office |
production |
2026-09-18 |
| elastic |
Suspicious Execution via Scheduled Task |
production |
2026-09-18 |
| elastic |
Creation or Modification of a new GPO Scheduled Task or Service |
production |
2026-09-18 |
| elastic |
UAC Bypass via DiskCleanup Scheduled Task Hijack |
production |
2026-09-18 |
| elastic |
Azure Automation Runbook Created or Modified |
production |
2026-09-18 |
| elastic |
Modification of Persistence Relevant Files Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Echo or Printf Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential Persistence via File Modification |
production |
2026-09-18 |
| elastic |
Suspicious Network Activity to the Internet by Previously Unknown Executable |
production |
2026-09-18 |
| elastic |
Suspicious Execution from Foomatic-rip or Cupsd Parent |
production |
2026-09-18 |
| elastic |
Pod or Container Creation with Suspicious Command-Line |
production |
2026-09-18 |
| elastic |
At Job Created or Modified |
production |
2026-09-18 |
| elastic |
Cron Job Created or Modified |
production |
2026-09-18 |
| splunk |
Schedule Task with Rundll32 Command Trigger |
production |
2026-05-13 |
| splunk |
Windows Hidden Schedule Task Settings |
production |
2026-05-13 |
| splunk |
Schedule Task with HTTP Command Arguments |
production |
2026-05-13 |
| splunk |
Schtasks Run Task On Demand |
production |
2026-05-13 |
| splunk |
Windows Scheduled Tasks for CompMgmtLauncher or Eventvwr |
production |
2026-05-13 |
| splunk |
Windows Scheduled Task DLL Module Loaded |
production |
2026-05-13 |
| splunk |
Windows Level RMM Watchdog Task Created |
production |
2026-05-13 |
| sigma |
Scheduled TaskCache Change by Uncommon Program |
test |
2025-10-22 |
| elastic |
Deprecated - Suspicious File Creation in /etc for Persistence |
deprecated |
2025-06-26 |
| sigma |
Cisco Modify Configuration |
test |
2025-04-28 |
| sigma |
HackTool - CrackMapExec Execution Patterns |
stable |
2023-11-06 |
| sigma |
Potential ACTINIUM Persistence Activity |
test |
2023-03-18 |
| sigma |
HAFNIUM Exchange Exploitation Activity |
test |
2023-03-09 |
| sigma |
HackTool - CrackMapExec Execution |
test |
2023-03-08 |
| sigma |
HackTool - SharPersist Execution |
test |
2023-02-04 |
| sigma |
Defrag Deactivation - Security |
test |
2022-11-27 |
| sigma |
Suspicious Scheduled Task Write to System32 Tasks |
test |
2022-01-12 |
| sigma |
Remote Schedule Task Lateral Movement via SASec |
test |
2022-01-01 |
| sigma |
Remote Schedule Task Lateral Movement via ITaskSchedulerService |
test |
2022-01-01 |
| sigma |
Remote Schedule Task Lateral Movement via ATSvc |
test |
2022-01-01 |
| elastic |
Potential Persistence via Cron Job |
deprecated |
2021-04-15 |