Scheduled Job Creation

The establishment of a task or job that will execute at a predefined time or based on specific triggers.

*Data Collection Measures: *

• Windows Event Logs:
  • Event ID 4698 (Scheduled Task Created) – Detects the creation of new scheduled tasks.
  • Event ID 4702 (Scheduled Task Updated) – Identifies modifications to existing scheduled jobs.
  • Event ID 106 (TaskScheduler Operational Log) – Provides details about scheduled task execution.
• Sysmon (Windows):
  • Event ID 1 (Process Creation) – Detects the execution of suspicious tasks started by schtasks.exe, at.exe, or taskeng.exe.
• Linux/macOS Monitoring:
  • AuditD: Monitor modifications to /etc/cron*, /var/spool/cron/, and crontab files.
  • Syslog: Capture cron job execution logs from /var/log/cron.
  • OSQuery: Query the crontab and launchd tables for scheduled job configurations.
• Endpoint Detection and Response (EDR) Tools:
  • Track scheduled task creation and modification events.
• SIEM & XDR Detection Rules:
  • Monitor for scheduled jobs created by unusual users.
  • Detect tasks executing scripts from non-standard directories.