Skip to content

Hide Navigation Hide TOC

Scheduled Job Modification (faa34cf6-cf32-4dc9-bd6a-8f7a606ff65b)

Changes made to a scheduled job, such as modifications to the execution launch (ex: Windows EID 4702 or /var/log cron logs)

Cluster A Galaxy A Cluster B Galaxy B Level
Clear Persistence - T1070.009 (d2c4e5ea-dbdf-4113-805a-b1e2a337fb33) Attack Pattern Scheduled Job Modification (faa34cf6-cf32-4dc9-bd6a-8f7a606ff65b) mitre-data-component 1
Scheduled Job Modification (faa34cf6-cf32-4dc9-bd6a-8f7a606ff65b) mitre-data-component Masquerading - T1036 (42e8de7b-37b2-4258-905a-6897815e58e0) Attack Pattern 1
Scheduled Job Modification (faa34cf6-cf32-4dc9-bd6a-8f7a606ff65b) mitre-data-component Indicator Removal - T1070 (799ace7f-e227-4411-baa0-8868704f2a69) Attack Pattern 1
Scheduled Job Modification (faa34cf6-cf32-4dc9-bd6a-8f7a606ff65b) mitre-data-component Masquerade Task or Service - T1036.004 (7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c) Attack Pattern 1
Clear Persistence - T1070.009 (d2c4e5ea-dbdf-4113-805a-b1e2a337fb33) Attack Pattern Indicator Removal - T1070 (799ace7f-e227-4411-baa0-8868704f2a69) Attack Pattern 2
Masquerading - T1036 (42e8de7b-37b2-4258-905a-6897815e58e0) Attack Pattern Masquerade Task or Service - T1036.004 (7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c) Attack Pattern 2