Potentially Suspicious Usage of Win32 ScheduledJob WMI Class

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects potential abuse of the Win32_ScheduledJob WMI class for creating or removing scheduled jobs. This WMI class, which is disabled by default for security reasons, manages AT.exe command-based scheduled jobs. Threat actors can exploit this class to execute malicious code at predetermined times or remove job to evade detection. The use of this WMI class instead of conventional scheduling methods may indicate suspicious activity.

2026-01-27 00:00:00

None

5d214e9a-d61c-4759-a6e2-d7aa5b95c7e7

attack.persistence attack.execution attack.privilege-escalation attack.t1053.002

Nextron Sigma feed only (private)