Browser LabLD-SOC2-LAB-002Hard
Browser LabLD-SOC2-LAB-002Hard22 min
Hunting a Scheduled-Task Persistence Hypothesis
Your hypothesis: 'A non-admin account created a scheduled task from a user-writable path in the last 7 days — possible persistence (ATT&CK T1053.005).' You pulled every Event 4698 (task creation) for the window. Work the hypothesis: pivot, rule out the benign explanation, judge confidence, and decide.
What you will be able to do
- Pivot the task-creation events down to the one candidate that matches the hypothesis.
- Test the competing benign explanation and decide whether it survives.
- State a confidence and match the action to it.
Threat HuntingLog AnalysisT1053.005 — Scheduled Task/Job: Scheduled Task
Sign in to start this lab.
Sign in