Windows Scheduled Task Object

oasis-tcs / cti-stix2

OASIS CTI TC: Provides issue tracking and wiki pages for the STIX 2.x Work Products

https://github.com/oasis-tcs/cti-stix2

Other

24 stars 9 forks source link

Windows Scheduled Task Object #45

Open ikiril01 opened 6 years ago

ikiril01 commented 6 years ago

Jason pointed out that we're missing a way of describing windows scheduled task, so we likely need to add a new Windows Scheduled Task Cyber Observable Object to do so.

JasonKeirstead commented 6 years ago

Use cases:

Detect the same Scheduled Task scheduled over Multiple Hosts with the same command line that is not in a white list
Detect any scheduled task configured to run with HighestAvailable priviledges