D3FEND 技术详情
D3-SJA
定义
Analysis of source files, processes, destination files, or destination servers associated with a scheduled job to detect unauthorized use of job scheduling.
父技术
子技术
无
关联构件
JobSchedule
Job Schedule
A job schedule contains specification of tasks to be executed at particular times or time intervals. The schedule is a plan that enacted by a task scheduling process. In Windows, the schedule can be accessed at 'C:\Windows\System32\Tasks' or in the registry. In Linux, the schedule is located at '/etc/crontab'
语义关系
出向analyzesJob Schedule
出向kb referenceReference - CAR-2013-05-004: Execution with AT - MITRE
出向kb referenceReference - CAR-2013-08-001: Execution with schtasks - MITRE
出向kb referenceReference - Preventing execution of task scheduled malware - McAfee LLC