Detection Gap: MITRE ATT&CK T1053.005 Scheduled Task Abuse Highlights SOC 2 Monitoring Gaps
What Happened — A Broadcom Symantec blog explains how attackers routinely abuse Windows scheduled tasks (ATT&CK T1053.005) to maintain persistence. The piece contrasts legitimate task creation (admin‑driven, ticketed, signed binaries) with malicious tasks that appear identical but lack change‑record provenance.
Why It Matters for Compliance & Audit Readiness
- SOC 2’s Change Management (CC6.1) and System Operations (CC7.1) controls require documented, auditable creation of scheduled jobs; undocumented tasks represent a control‑failure gap.
- Continuous evidence collection of task‑creation events feeds a defensible audit trail and satisfies the “monitoring of system components” criterion.
- Verisq’s Control Mapping capability can automatically correlate scheduled‑task logs with change‑ticket data, turning raw event streams into SOC 2‑ready evidence.
Who Is Affected — Enterprises with Windows‑based infrastructure, especially those in technology, finance, and healthcare that rely on automated jobs for patching, backups, or data pipelines.
Recommended Actions
- Map scheduled‑task creation to a documented change‑management workflow; enforce ticket linkage before task deployment.
- Deploy continuous log‑collection and correlation (e.g., Sysmon + SIEM) to capture the full creation chain for audit evidence.
- Periodically review task inventories against a baseline of known, signed binaries and privileged accounts.
Source: Broadcom Symantec Blog – Detection Gap: MITRE ATT&CK T1053.005
Technical Notes
- ATT&CK technique T1053.005 leverages
schtasks.exe, a signed Windows utility, making signature‑based detection ineffective. - Malicious tasks often run under the
SYSTEMaccount, launch unsigned binaries from temporary paths, and lack associated change tickets. - Detection relies on contextual enrichment (who, when, what) rather than simple file‑hash alerts.