Question

A threat hunter at a large enterprise is investigating suspected persistence following a phishing campaign. They collect scheduled task inventories from 8,000 Windows endpoints and want to surface malicious persistence with the fewest false positives. Which analytical approach will most effectively isolate anomalous scheduled tasks used for persistence?

Accepted Answer

Frequency (stack-count) analysis across the fleet to flag scheduled tasks that appear on only a small number of hosts and invoke uncommon binaries or command lines

Answer

Alert on every scheduled task that runs with SYSTEM privileges, since malware requires elevated context to persist

Answer

Compare each endpoint's task list against a single golden-image baseline captured at provisioning time

Answer

Query threat-intel feeds for known-bad task names and match them against the collected inventory