The establishment of a task or job that will execute at a predefined time or based on specific triggers.
| Name | Channel |
|---|---|
| esxi:cron | execution of scheduled job |
| esxi:hostd | task creation events |
| esxi:vmkernel | Startup script and task execution logs |
| kubernetes:apiserver | verb=create, resource=cronjobs, group=batch |
| linux:cron | Scheduled execution of unknown or unusual script/binary |
| linux:osquery | crontab, systemd_timers |
| linux:osquery | file_events |
| linux:syslog | Execution of non-standard script or binary by cron |
| macos:cron | cron/launchd |
| macos:osquery | launchd_jobs |
| macos:osquery | file_events - cron, launchd |
| macos:unifiedlog | process: crontab edits, launch of cron job |
| mobile:ForensicArtifacts | Dynamic filesystem trace or acquired app-container/filesystem artifacts: Scheduled task execution creates file, accesses sensor, or initiates network connection immediately after firing, with no recent user interaction triggering the task |
| mobile:ForensicArtifacts | Dynamic filesystem trace or acquired app-container/filesystem artifacts: Scheduled task execution produces network, local-write, or sensor artifact while app_state=background or device_locked=true without user trigger |
| MobiledEDR:telemetry | Scheduled task execution creates cache, staged payload, local output, or collected data artifact immediately after wake or job trigger |
| Scheduled Job | None |
| WinEventLog:Security | EventCode=4698 |
| WinEventLog:Security | EventCode=4699 |
| WinEventLog:Security | Windows Security Event ID 4698/4702: EventCode=4698 referencing Industrial Control Systems (ICS) vendor binary name from unauthorized process |
| WinEventLog:TaskScheduler | EventCode=106 |