Rule Info
Name
Atexec Execution Pattern - Scheduled Task Creation
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects the creation of scheduled tasks creation pattern during atexec execution.
Atexec is a tool in the Impacket suite that allows attackers to execute commands on remote systems.
Typically, Atexec creates a scheduled task on the target system to execute the command.
Reference
Date
2025-02-07 00:00:00
Modified
None
Id
770f6558-077f-4929-b369-02197b8c7dba
Tags
attack.execution attack.privilege-escalation attack.persistence attack.t1053.005
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR