Detection rules › By catalog entry

Microsoft-Windows-TaskScheduler

Catalog entry	Rules
Event ID 129	3
Event ID 140	1
Event ID 141	2
Event ID 142	1
Event ID 200	1
Event ID 201	1

Event ID 129

3 detection rules reference this catalog entry. View catalog entry.

Sigma (3)

Scheduled Task Executed From A Suspicious Location severity medium T1053,T1053.005
Scheduled Task Executed Uncommon LOLBIN severity medium T1053,T1053.005
Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor - Task Scheduler severity high

Event ID 140

1 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor - Task Scheduler severity high

Event ID 141

2 detection rules reference this catalog entry. View catalog entry.

Sigma (2)

Important Scheduled Task Deleted or Disabled severity high T1489
Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor - Task Scheduler severity high

Event ID 142

1 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

Important Scheduled Task Deleted or Disabled severity high T1489

Event ID 200

1 detection rules reference this catalog entry. View catalog entry.

Splunk (1)

WinEvent Windows Task Scheduler Event Action Started T1053,T1053.005

Event ID 201

1 detection rules reference this catalog entry. View catalog entry.

Splunk (1)

WinEvent Windows Task Scheduler Event Action Started T1053,T1053.005

Back to all Microsoft-Windows-TaskScheduler catalog entries