Win32_ScheduledJob Class or At.exe Enabled - Process

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the enabling of the Win32_ScheduledJob WMI class or At.exe via registry modification. The Win32_ScheduledJob class is used to create and manage scheduled jobs in Windows. This class is disabled by default for security reasons, and enabling it may indicate an attempt to create or manage scheduled jobs in a potentially malicious manner.

2026-01-29 00:00:00

None

cda43885-b606-4cff-92b0-4e0bba171950

attack.persistence attack.execution attack.privilege-escalation attack.t1053.002

Nextron Sigma feed only (private)