medium10 pts · first answer countswindows-event-logsmitre-attackalert-triage

A suspicious scheduled task

Which event shows a likely persistence mechanism on this host?

EventID: 4698  A scheduled task was created
Task Name: \MicrosoftEdgeUpdateCheck
Command: C:\Users\Public\upd.exe
Trigger: At logon, every user
Author: CORP\j.smith

A.It is safe because the task name mentions Microsoft EdgeB.It is a failed logon attemptC.It is a task running an executable from C:\Users\Public at every logon, a common persistence trick with a disguised nameD.It shows a software update that Windows Update installed

Discussion 0

Join free to post in the discussion.

A suspicious scheduled task

Discussion 0

Related questions