Question

You are a SOC analyst in Microsoft Sentinel. Threat intelligence reports indicate that an actor is abusing scheduled tasks for persistence across your environment. You want to proactively search historical data for this behavior before an incident is raised, track which MITRE ATT&CK techniques your queries cover, and save promising findings for later investigation without generating alerts. Which Sentinel capability should you use as the primary starting point?

Accepted Answer

Use the Hunting page to run and manage hunting queries mapped to MITRE ATT&CK tactics and techniques, then bookmark noteworthy results

Answer

Create a scheduled analytics rule with entity mapping so incidents are generated automatically when the persistence behavior recurs

Answer

Enable UEBA and review the entity behavior timeline for anomalous scheduled task activity

Answer

Configure a Fusion rule to correlate scheduled task events across multiple data connectors into a multistage incident