Win32_ScheduledJob Class or At.exe Enabled - Registry

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the enabling of the Win32_ScheduledJob WMI class or At.exe via registry modification. The Win32_ScheduledJob class is used to create and manage scheduled jobs in Windows. This class is disabled by default for security reasons, and enabling it may indicate an attempt to create or manage scheduled jobs in a potentially malicious manner.

2026-01-29 00:00:00

None

d8f32c5b-50de-4cfd-8536-a75b2c64d896

attack.persistence attack.execution attack.privilege-escalation attack.t1053.002

Nextron Sigma feed only (private)