Remote Scheduled Task Lateral Movement via ATSvc

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•33

Detects remote RPC calls to create or execute a scheduled task via the Advanced Telephony Service (ATSvc) interface. This activity can be indicative of lateral movement, privilege escalation, or persistence mechanisms used by adversaries.