Procedure examples

TrickBot creates a scheduled task on the system that provides persistence.

Bumblebee can achieve persistence by copying its DLL to a subdirectory of %APPDATA% and creating a Visual Basic Script that will load the DLL via a scheduled task.

GRIFFON has used sctasks for persistence.

yty establishes persistence by creating a scheduled task with the command SchTasks /Create /SC DAILY /TN BigData /TR “ + path_file + “/ST 09:30“.

Stuxnet schedules a network job to execute two minutes after host infection.

POWRUNER persists through a scheduled task that executes it every minute.

SharpStage has a persistence component to write a scheduled task for the payload.

Smoke Loader launches a scheduled task.

Matryoshka can establish persistence by adding a Scheduled Task named "Microsoft Boost Kernel Optimization".

GravityRAT creates a scheduled task to ensure it is re-executed everyday.

Prestige has been executed on a target system through a scheduled task created by Sandworm Team using Impacket.

SharpDisco can create scheduled tasks to execute reverse shells that read and write data to and from specified SMB shares.

TONESHELL has created scheduled tasks to maintain persistence.

RainyDay can use scheduled tasks to achieve persistence.

NETWIRE can create a scheduled task to establish persistence.

Bad Rabbit’s infpub.dat file creates a scheduled task to launch a malicious executable.

CosmicDuke uses scheduled tasks typically named "Watchmon Service" for persistence.

IMAPLoader creates scheduled tasks for persistence based on the operating system version of the victim machine.

Emotet has maintained persistence through a scheduled task, e.g. though a .dll file in the Registry.

Tomiris has used `SCHTASKS /CREATE /SC DAILY /TN StartDVL /TR "[path to self]" /ST 10:00` to establish persistence.

BADHATCH can use `schtasks.exe` to gain persistence.

The different components of Machete are executed by Windows Task Scheduler.

PUBLOAD has created scheduled tasks to maintain persistence with the command `schtasks.exe /F /Create /TN Microsoft_Licensing /sc minute /MO 1 /TR C:\\Users\\Public\\Libraries\...`

SystemBC has executed a copy of itself as a scheduled task with the `start` command. The copy of SystemBC has random file and directory names within the ProgramData directory.

InvisiMole has used scheduled tasks named MSST and \Microsoft\Windows\Autochk\Scheduled to establish persistence.

CLAIMLOADER has created scheduled tasks that execute the loader every five(5) minutes using `schtasks /F /Create /TN \"<fake_software_name>\" /SC minute /MO 5 /TR
\"C:\\ProgramData\\<path_to_exe> <hardcoded_argument>\`.

Apostle achieves persistence by creating a scheduled task, such as MicrosoftCrashHandlerUAC.

Okrum's installer can attempt to achieve persistence by creating a scheduled task.

SameCoin has the ability to set a scheduled task for execution.

RemoteCMD can execute commands remotely by creating a new schedule task on the remote system

IcedID has created a scheduled task to establish persistence.

Nightdoor uses scheduled tasks for persistence to load the final malware payload into memory.

CHIMNEYSWEEP can use the Windows `SilentCleanup` scheduled task to enable payload execution.

Lucifer has established persistence by creating the following scheduled task schtasks /create /sc minute /mo 1 /tn QQMusic ^ /tr C:Users\%USERPROFILE%\Downloads\spread.exe /F.

zwShell has used SchTasks for execution.

NotPetya creates a task to reboot the system one hour after infection.

ISMInjector creates scheduled tasks to establish persistence.

GoldMax has used scheduled tasks to maintain persistence.

Anchor can create a scheduled task for persistence.

Pteranodon schedules tasks to invoke its components in order to establish persistence.

DarkWatchman has created a scheduled task for persistence.

Dyre has the ability to achieve persistence by adding a new task in the task scheduler to run every minute.

PlugX has created a scheduled task to execute additional malicious software, as well as maintain persistence.

MultiLayer Wiper creates a malicious scheduled task that launches a batch file to remove Windows Event Logs.

Remsec schedules the execution one of its modules by creating a new scheduler task.

PureCrypter can maintain persistence with scheduled tasks.

SVCReady can create a scheduled task named `RecoveryExTask` to gain persistence.

Gazer can establish persistence by creating a scheduled task.

Latrodectus can create scheduled tasks for persistence.

Saint Bot has created a scheduled task named "Maintenance" to establish persistence.