Scheduled Task Creation with System Binary Masquerading

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the creation of scheduled tasks that execute the binaries having same names to Windows system binaries, indicating potential masquerading. Adversaries commonly create scheduled tasks with names resembling legitimate system binaries to maintain persistence and evade detection. This technique helps them preserve system access after reboots or system changes while avoiding suspicion.

Internal Research

2025-04-07 00:00:00

None

1c70633e-19c7-49c8-aa21-6d83f6b5c9b7

attack.persistence attack.t1053.005 attack.defense-evasion attack.t1036.005

Nextron Sigma feed only (private)