AN0258
Analytic 0258
Windows
Detects creation or modification of scheduled tasks using schtasks.exe, at.exe, or COM objects followed by execution of outlier processes tied to the scheduled job.
WinEventLog:Security
EventCode=4698
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=2
[TaskAuthor]
Unexpected user or account context initiating the task.
[CommandLineRegex]
Suspicious binaries or script usage tied to scheduled tasks.
[ExecutionWindow]
Lookback window to correlate process execution after task registration.
AN0259
Analytic 0259
Linux
Detects creation or modification of cron jobs via crontab, /etc/cron.* directories, or systemd timer units with execution by unusual users or non-standard intervals.
auditd:SYSCALL
write, rename
auditd:SYSCALL
execve
linux:osquery
crontab, systemd_timers
[CronSchedulePattern]
Look for high-frequency or off-hour scheduling patterns.
[ServiceUser]
Unusual users scheduling jobs (e.g., www-data, nobody).
[BinaryEntropy]
Abnormal scripts or binaries tied to the scheduled job.
AN0260
Analytic 0260
macOS
Detects creation or alteration of LaunchAgents or LaunchDaemons with corresponding plist modification followed by execution of associated binaries.
macos:unifiedlog
process launch
fs:fsusage
disk activity on /Library/LaunchAgents or LaunchDaemons
macos:osquery
launchd_jobs
[PlistLabel]
Labels not associated with known applications or vendors.
[LaunchPath]
Executable path outside of standard directories (/usr/bin, /Applications).
[JobRunInterval]
Unexpected periodic job intervals (e.g., every minute).
AN0261
Analytic 0261
Containers
Detects unusual use of `cron` or `sleep` loops inside containers executing unfamiliar scripts or binaries repeatedly.
auditd:SYSCALL
execve
containerd:runtime
file change monitoring within /etc/cron.*, /tmp, or mounted volumes
[ContainerLabel]
Labels or tags indicating dev/test containers executing scheduled tasks.
[ScriptFrequency]
Repetitive invocation pattern within short container lifespan.
[ImageSource]
Unexpected container image sources creating cron entries.
AN0262
Analytic 0262
ESXi
Detects modification of ESXi cron jobs, local.sh scripts, or scheduled API calls to persist custom binaries or shell scripts.
esxi:vmkernel
Startup script and task execution logs
esxi:hostd
shell access or job registration
esxi:cron
manual edits to /etc/rc.local.d/local.sh or cron.d
[StartupScriptName]
Filename not matching expected initialization scripts.
[ExecutionContext]
Commands run from unexpected SSH sessions or elevated shells.
[PersistenceInterval]
Rare scheduling triggers (e.g., @reboot + hourly repetition).