Interview question
An endpoint alert shows that a scheduled task was created which launches a PowerShell one-liner from a user's AppData directory. Map this to MITRE ATT&CK.
A mapping question with a deliberate trap: the evidence is ambiguous, and the correct answer includes saying so rather than committing to a single technique ID.
What a strong answer covers
- Scheduled task creation maps to T1053 Scheduled Task/Job, sub-technique T1053.005 Scheduled Task on Windows.
- PowerShell execution maps to T1059 Command and Scripting Interpreter, sub-technique T1059.001 PowerShell.
- Notes that T1053 can sit under Persistence, Execution or Privilege Escalation depending on the adversary's intent, which is not yet known.
- Explicitly separates observation from inference — this is an observation, maliciousness is not established.
- Names benign explanations: legitimate updaters and management software create scheduled tasks that invoke PowerShell.
- States what additional evidence would disambiguate: the full command line, parent process, task author, signing status, what the script does, network activity afterwards.
- Does not name an actor or a malware family from this evidence.
Expert answer
Two techniques are in play. The scheduled task maps to T1053 Scheduled Task/Job, specifically T1053.005 Scheduled Task on Windows. The PowerShell invocation maps to T1059 Command and Scripting Interpreter, specifically T1059.001 PowerShell.
The tactic assignment is genuinely uncertain, and saying so is part of the answer. T1053 appears under Persistence, Execution and Privilege Escalation. Which applies depends on what the adversary was trying to achieve, and I cannot tell that from a task creation event alone. If it runs at logon to re-establish access, that is Persistence. If it is a one-shot execution vehicle, that is Execution. If it runs as SYSTEM when the creating user could not, that is Privilege Escalation.
I would also be explicit that this is an observation, not a finding. Plenty of legitimate software creates scheduled tasks that call PowerShell — updaters, endpoint management agents, backup tools. The location under AppData raises the prior somewhat because user-writable paths are a common choice for tooling that cannot write to Program Files, but it is not decisive on its own.
To disambiguate I would want: the full command line including any encoded or obfuscated arguments, the parent process that created the task, the task author and the account context it runs under, whether any dropped file is signed, what the script actually does, and whether the host generated outbound network activity in the following minutes.
I would not attach a family or an actor to this. There is nothing here that supports it.
Mistakes that cost candidates points
- Committing to a single technique ID and tactic without noting the ambiguity.
- Missing the PowerShell technique or the scheduled task technique.
- Failing to raise benign explanations, which signals alert-confirmation rather than analysis.
- Naming a malware family or actor from a scheduled task alone.
- Not stating what further evidence would resolve the question.
You have read the answer, which is the easy part. Answer it in your own words and get graded against this same rubric, with the follow-up probe an interviewer would ask next.
Go deeper
Related questions
- Your CISO has seen an ATT&CK coverage heat map showing 70% of techniques as "covered" and wants to know if that means we are 70% secure. What do you say?
- How do the Diamond Model, the Cyber Kill Chain and MITRE ATT&CK relate to each other? Do they compete?
- You have one piece of evidence: a single IP address that a compromised host was beaconing to. Walk me through how you would develop this.
- Your CISO says "I want to know about ransomware." Turn that into something you can actually collect against.
- What is F3EAD, and why do some CTI teams prefer it to the traditional intelligence cycle?