SOC144 EventID:91 —  New scheduled task created — letsdefend.io

SOC144 EventID:91 — New scheduled task created — letsdefend.io

Before solving the alert, here is the data provided about the case:

We are dealing with a python file named “Sorted-Algorithm.py”. As long as we don’t run it, it’s okay to download the file and review the code since this is just a python source code, basically a plaintext.

So let’s have a look at the content.

import urllib.request
import os

print(r"""\

                                   ._ o o
                                   \_`-)|_
                                ,""       \ 
                              ,"  ## | …

incident response letsdefendio soc