The establishment of a task or job that will execute at a predefined time or based on specific triggers.
| Name | Channel |
|---|---|
| esxi:cron | execution of scheduled job |
| esxi:hostd | task creation events |
| esxi:vmkernel | Startup script and task execution logs |
| kubernetes:apiserver | verb=create, resource=cronjobs, group=batch |
| linux:cron | Scheduled execution of unknown or unusual script/binary |
| linux:osquery | crontab, systemd_timers |
| linux:osquery | file_events |
| linux:syslog | Execution of non-standard script or binary by cron |
| macos:cron | cron/launchd |
| macos:osquery | launchd_jobs |
| macos:osquery | file_events - cron, launchd |
| macos:unifiedlog | process: crontab edits, launch of cron job |
| MobiledEDR:telemetry | Scheduled task execution creates cache, staged payload, local output, or collected data artifact immediately after wake or job trigger |
| Scheduled Job | None |
| WinEventLog:Security | EventCode=4698 |
| WinEventLog:Security | EventCode=4699 |
| WinEventLog:TaskScheduler | EventCode=106 |