Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Windows Scheduled Task Object #45

Open
ikiril01 opened this issue Nov 22, 2017 · 1 comment
Open

Windows Scheduled Task Object #45

ikiril01 opened this issue Nov 22, 2017 · 1 comment
Labels
Need to Discuss STIX: Observables Target: STIX-2.2 Type: New Feature

Comments

@ikiril01
Copy link

Jason pointed out that we're missing a way of describing windows scheduled task, so we likely need to add a new Windows Scheduled Task Cyber Observable Object to do so.
@JasonKeirstead
Copy link

Use cases:

  • Detect the same Scheduled Task scheduled over Multiple Hosts with the same command line that is not in a white list
  • Detect any scheduled task configured to run with HighestAvailable priviledges

@jordan2175 jordan2175 added this to the 2.2-csd01-wd01 milestone May 29, 2019
@jordan2175 jordan2175 modified the milestones: 2.2-csd01-wd01, unknown Jul 2, 2019
@jordan2175 jordan2175 removed this from the unknown milestone Feb 13, 2020
@securitiz securitiz mentioned this issue Sep 30, 2021
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Need to Discuss STIX: Observables Target: STIX-2.2 Type: New Feature
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@johnwunder @ikiril01 @JasonKeirstead @jordan2175 @srrelitz2