Scheduled Task/Job - T1053

        graph LR;

     T1053["Scheduled Task/Job"] --> |modifies| JobSchedule["Job Schedule"]; class T1053 OffensiveTechniqueNode;
        class JobSchedule ArtifactNode; click JobSchedule href "../../../dao/artifact/d3f:JobSchedule";
        click T1053 href "../../../offensive-technique/attack/T1053/"; click JobSchedule href "../../../dao/artifact/d3f:JobSchedule"; T1053["Scheduled Task/Job"] --> |invokes| CreateProcess["Create Process"]; class T1053 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";
        click T1053 href "../../../offensive-technique/attack/T1053/"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess"; T1053["Scheduled Task/Job"] --> |executes| ScheduledJob["Scheduled Job"]; class T1053 OffensiveTechniqueNode;
        class ScheduledJob ArtifactNode; click ScheduledJob href "../../../dao/artifact/d3f:ScheduledJob";
        click T1053 href "../../../offensive-technique/attack/T1053/"; click ScheduledJob href "../../../dao/artifact/d3f:ScheduledJob"; T1053["Scheduled Task/Job"] --> |creates| PropertyListFile["Property List File"]; class T1053 OffensiveTechniqueNode;
        class PropertyListFile ArtifactNode; click PropertyListFile href "../../../dao/artifact/d3f:PropertyListFile";
        click T1053 href "../../../offensive-technique/attack/T1053/"; click PropertyListFile href "../../../dao/artifact/d3f:PropertyListFile";                                                    DecoyFile["Decoy File"] -->
          | spoofs | PropertyListFile["Property List File"];

          DecoyFile["Decoy File"] -.->
            | may-deceive | T1053["Scheduled Task/Job"] ;
          class DecoyFile DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click DecoyFile href "../../../technique/d3f:DecoyFile";              SystemCallAnalysis["System Call Analysis"] -->
          | analyzes | CreateProcess["Create Process"];

          SystemCallAnalysis["System Call Analysis"] -.->
            | may-detect | T1053["Scheduled Task/Job"] ;
          class SystemCallAnalysis DefensiveTechniqueNode;
          class CreateProcess ArtifactNode;
          click SystemCallAnalysis href "../../../technique/d3f:SystemCallAnalysis"; ProcessSelf-ModificationDetection["Process Self-Modification Detection"] -->
          | analyzes | ScheduledJob["Scheduled Job"];

          ProcessSelf-ModificationDetection["Process Self-Modification Detection"] -.->
            | may-detect | T1053["Scheduled Task/Job"] ;
          class ProcessSelf-ModificationDetection DefensiveTechniqueNode;
          class ScheduledJob ArtifactNode;
          click ProcessSelf-ModificationDetection href "../../../technique/d3f:ProcessSelf-ModificationDetection"; ProcessSpawnAnalysis["Process Spawn Analysis"] -->
          | analyzes | ScheduledJob["Scheduled Job"];

          ProcessSpawnAnalysis["Process Spawn Analysis"] -.->
            | may-detect | T1053["Scheduled Task/Job"] ;
          class ProcessSpawnAnalysis DefensiveTechniqueNode;
          class ScheduledJob ArtifactNode;
          click ProcessSpawnAnalysis href "../../../technique/d3f:ProcessSpawnAnalysis"; ProcessSpawnAnalysis["Process Spawn Analysis"] -->
          | analyzes | CreateProcess["Create Process"];

          
          class ProcessSpawnAnalysis DefensiveTechniqueNode;
          class CreateProcess ArtifactNode;
          click ProcessSpawnAnalysis href "../../../technique/d3f:ProcessSpawnAnalysis";                                                     FileIntegrityMonitoring["File Integrity Monitoring"] -->
          | analyzes | PropertyListFile["Property List File"];

          FileIntegrityMonitoring["File Integrity Monitoring"] -.->
            | may-detect | T1053["Scheduled Task/Job"] ;
          class FileIntegrityMonitoring DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click FileIntegrityMonitoring href "../../../technique/d3f:FileIntegrityMonitoring";              HostShutdown["Host Shutdown"] -->
          | terminates | ScheduledJob["Scheduled Job"];

          HostShutdown["Host Shutdown"] -.->
            | may-evict | T1053["Scheduled Task/Job"] ;
          class HostShutdown DefensiveTechniqueNode;
          class ScheduledJob ArtifactNode;
          click HostShutdown href "../../../technique/d3f:HostShutdown"; ProcessTermination["Process Termination"] -->
          | terminates | ScheduledJob["Scheduled Job"];

          ProcessTermination["Process Termination"] -.->
            | may-evict | T1053["Scheduled Task/Job"] ;
          class ProcessTermination DefensiveTechniqueNode;
          class ScheduledJob ArtifactNode;
          click ProcessTermination href "../../../technique/d3f:ProcessTermination";                           ProcessSuspension["Process Suspension"] -->
          | suspends | ScheduledJob["Scheduled Job"];

          ProcessSuspension["Process Suspension"] -.->
            | may-evict | T1053["Scheduled Task/Job"] ;
          class ProcessSuspension DefensiveTechniqueNode;
          class ScheduledJob ArtifactNode;
          click ProcessSuspension href "../../../technique/d3f:ProcessSuspension";              FileEviction["File Eviction"] -->
          | deletes | PropertyListFile["Property List File"];

          FileEviction["File Eviction"] -.->
            | may-evict | T1053["Scheduled Task/Job"] ;
          class FileEviction DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click FileEviction href "../../../technique/d3f:FileEviction";              ContentModification["Content Modification"] -->
          | modifies | PropertyListFile["Property List File"];

          ContentModification["Content Modification"] -.->
            | may-isolate | T1053["Scheduled Task/Job"] ;
          class ContentModification DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click ContentModification href "../../../technique/d3f:ContentModification"; ContentQuarantine["Content Quarantine"] -->
          | quarantines | PropertyListFile["Property List File"];

          ContentQuarantine["Content Quarantine"] -.->
            | may-isolate | T1053["Scheduled Task/Job"] ;
          class ContentQuarantine DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click ContentQuarantine href "../../../technique/d3f:ContentQuarantine";                           ExecutableDenylisting["Executable Denylisting"] -->
          | filters | CreateProcess["Create Process"];

          ExecutableDenylisting["Executable Denylisting"] -.->
            | may-isolate | T1053["Scheduled Task/Job"] ;
          class ExecutableDenylisting DefensiveTechniqueNode;
          class CreateProcess ArtifactNode;
          click ExecutableDenylisting href "../../../technique/d3f:ExecutableDenylisting"; Application-basedProcessIsolation["Application-based Process Isolation"] -->
          | isolates | ScheduledJob["Scheduled Job"];

          Application-basedProcessIsolation["Application-based Process Isolation"] -.->
            | may-isolate | T1053["Scheduled Task/Job"] ;
          class Application-basedProcessIsolation DefensiveTechniqueNode;
          class ScheduledJob ArtifactNode;
          click Application-basedProcessIsolation href "../../../technique/d3f:Application-basedProcessIsolation"; Kernel-basedProcessIsolation["Kernel-based Process Isolation"] -->
          | isolates | ScheduledJob["Scheduled Job"];

          Kernel-basedProcessIsolation["Kernel-based Process Isolation"] -.->
            | may-isolate | T1053["Scheduled Task/Job"] ;
          class Kernel-basedProcessIsolation DefensiveTechniqueNode;
          class ScheduledJob ArtifactNode;
          click Kernel-basedProcessIsolation href "../../../technique/d3f:Kernel-basedProcessIsolation";     Hardware-basedProcessIsolation["Hardware-based Process Isolation"] -->
          | restricts | CreateProcess["Create Process"];

          Hardware-basedProcessIsolation["Hardware-based Process Isolation"] -.->
            | may-isolate | T1053["Scheduled Task/Job"] ;
          class Hardware-basedProcessIsolation DefensiveTechniqueNode;
          class CreateProcess ArtifactNode;
          click Hardware-basedProcessIsolation href "../../../technique/d3f:Hardware-basedProcessIsolation";                                    FileEncryption["File Encryption"] -->
          | encrypts | PropertyListFile["Property List File"];

          FileEncryption["File Encryption"] -.->
            | may-harden | T1053["Scheduled Task/Job"] ;
          class FileEncryption DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click FileEncryption href "../../../technique/d3f:FileEncryption";               Hardware-basedProcessIsolation["Hardware-based Process Isolation"] -->
          | isolates | ScheduledJob["Scheduled Job"];

          
          class Hardware-basedProcessIsolation DefensiveTechniqueNode;
          class ScheduledJob ArtifactNode;
          click Hardware-basedProcessIsolation href "../../../technique/d3f:Hardware-basedProcessIsolation";                          ExecutableAllowlisting["Executable Allowlisting"] -->
          | filters | CreateProcess["Create Process"];

          ExecutableAllowlisting["Executable Allowlisting"] -.->
            | may-isolate | T1053["Scheduled Task/Job"] ;
          class ExecutableAllowlisting DefensiveTechniqueNode;
          class CreateProcess ArtifactNode;
          click ExecutableAllowlisting href "../../../technique/d3f:ExecutableAllowlisting";              SystemCallFiltering["System Call Filtering"] -->
          | isolates | ScheduledJob["Scheduled Job"];

          SystemCallFiltering["System Call Filtering"] -.->
            | may-isolate | T1053["Scheduled Task/Job"] ;
          class SystemCallFiltering DefensiveTechniqueNode;
          class ScheduledJob ArtifactNode;
          click SystemCallFiltering href "../../../technique/d3f:SystemCallFiltering"; SystemCallFiltering["System Call Filtering"] -->
          | filters | CreateProcess["Create Process"];

          
          class SystemCallFiltering DefensiveTechniqueNode;
          class CreateProcess ArtifactNode;
          click SystemCallFiltering href "../../../technique/d3f:SystemCallFiltering";                           LocalFilePermissions["Local File Permissions"] -->
          | restricts | PropertyListFile["Property List File"];

          LocalFilePermissions["Local File Permissions"] -.->
            | may-isolate | T1053["Scheduled Task/Job"] ;
          class LocalFilePermissions DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click LocalFilePermissions href "../../../technique/d3f:LocalFilePermissions";              RestoreFile["Restore File"] -->
          | restores | PropertyListFile["Property List File"];

          RestoreFile["Restore File"] -.->
            | may-restore | T1053["Scheduled Task/Job"] ;
          class RestoreFile DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click RestoreFile href "../../../technique/d3f:RestoreFile";              FileAnalysis["File Analysis"] -->
          | analyzes | PropertyListFile["Property List File"];

          FileAnalysis["File Analysis"] -.->
            | may-detect | T1053["Scheduled Task/Job"] ;
          class FileAnalysis DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click FileAnalysis href "../../../technique/d3f:FileAnalysis"; ContentFiltering["Content Filtering"] -->
          | filters | PropertyListFile["Property List File"];

          ContentFiltering["Content Filtering"] -.->
            | may-isolate | T1053["Scheduled Task/Job"] ;
          class ContentFiltering DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click ContentFiltering href "../../../technique/d3f:ContentFiltering";                           ProcessLineageAnalysis["Process Lineage Analysis"] -->
          | analyzes | ScheduledJob["Scheduled Job"];

          ProcessLineageAnalysis["Process Lineage Analysis"] -.->
            | may-detect | T1053["Scheduled Task/Job"] ;
          class ProcessLineageAnalysis DefensiveTechniqueNode;
          class ScheduledJob ArtifactNode;
          click ProcessLineageAnalysis href "../../../technique/d3f:ProcessLineageAnalysis";              ScheduledJobAnalysis["Scheduled Job Analysis"] -->
          | analyzes | JobSchedule["Job Schedule"];

          ScheduledJobAnalysis["Scheduled Job Analysis"] -.->
            | may-detect | T1053["Scheduled Task/Job"] ;
          class ScheduledJobAnalysis DefensiveTechniqueNode;
          class JobSchedule ArtifactNode;
          click ScheduledJobAnalysis href "../../../technique/d3f:ScheduledJobAnalysis";              SystemDaemonMonitoring["System Daemon Monitoring"] -->
          | monitors | ScheduledJob["Scheduled Job"];

          SystemDaemonMonitoring["System Daemon Monitoring"] -.->
            | may-detect | T1053["Scheduled Task/Job"] ;
          class SystemDaemonMonitoring DefensiveTechniqueNode;
          class ScheduledJob ArtifactNode;
          click SystemDaemonMonitoring href "../../../technique/d3f:SystemDaemonMonitoring";              HostReboot["Host Reboot"] -->
          | terminates | ScheduledJob["Scheduled Job"];

          HostReboot["Host Reboot"] -.->
            | may-evict | T1053["Scheduled Task/Job"] ;
          class HostReboot DefensiveTechniqueNode;
          class ScheduledJob ArtifactNode;
          click HostReboot href "../../../technique/d3f:HostReboot";              RemoteFileAccessMediation["Remote File Access Mediation"] -->
          | isolates | PropertyListFile["Property List File"];

          RemoteFileAccessMediation["Remote File Access Mediation"] -.->
            | may-isolate | T1053["Scheduled Task/Job"] ;
          class RemoteFileAccessMediation DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click RemoteFileAccessMediation href "../../../technique/d3f:RemoteFileAccessMediation";