The Case of the Disappearing Scheduled Task

This episode is based upon a Microsoft Detection and Response (DART) blog post (see Resources section). I, along with two of my colleagues (Johnathan Sykes and Meaghan Bradshaw), performed extensive research regarding two different methods by which it is possible to create "hidden" Scheduled Tasks. While one of the methods has been discussed before, this research shows how it might be leveraged by a Threat Actor. The second technique, as best we can tell, is novel.

*** If you enjoy …

case scheduled task task