Procedure examples

MuddyWater has used scheduled tasks to establish persistence.

Naikon has used schtasks.exe for lateral movement in compromised networks.

FIN6 has used scheduled tasks to establish persistence for various malware it uses, including downloaders known as HARDTACK and SHIPBREAD and FrameworkPOS.

Gamaredon Group has created scheduled tasks to launch executables after a designated number of minutes have passed.

FIN7 malware has created scheduled tasks to establish persistence. Specifically, FIN7 has used OpenSSH to establish persistence.

Sandworm Team leveraged SHARPIVORY, a .NET dropper that writes embedded payload to disk and uses scheduled tasks to persist on victim machines.

Machete has created scheduled tasks to maintain Machete's persistence.

Mustang Panda has created a scheduled task to execute additional malicious software, as well as maintain persistence. Mustang Panda has also created a scheduled task that creates a reverse shell.

APT39 has created scheduled tasks for persistence.

TA2541 has used scheduled tasks to establish persistence for installed tools.

APT37 has created scheduled tasks to run malicious scripts on a compromised host.

OilRig has created scheduled tasks that run a VBScript to execute a payload on victim machines.

Higaisa dropped and added officeupdate.exe to scheduled tasks.

Confucius has created scheduled tasks to maintain persistence on a compromised host.

Blue Mockingbird has used Windows Scheduled Tasks to establish persistence on local and remote hosts.

Winter Vivern executed PowerShell scripts that would subsequently attempt to establish persistence by creating scheduled tasks objects to periodically retrieve and execute remotely-hosted payloads.

Storm-0501 had used a scheduled task named “SysUpdate” that was registered via GPO on devices in the network to distribute the Embargo ransomware.

BITTER has used scheduled tasks for persistence and execution.

RedCurl has created scheduled tasks for persistence.

Stealth Falcon malware creates a scheduled task entitled “IE Web Cache” to execute a malicious file hourly.

APT29 has used named and hijacked scheduled tasks to establish persistence.

Chimera has used scheduled tasks to invoke Cobalt Strike including through batch script schtasks /create /ru "SYSTEM" /tn "update" /tr "cmd /c c:\windows\temp\update.bat" /sc once /f /st and to maintain persistence.

BRONZE BUTLER has used schtasks to register a scheduled task to execute malware during lateral movement.

Ember Bear uses remotely scheduled tasks to facilitate remote command execution on victim machines.

ToddyCat has used scheduled tasks to execute discovery commands and scripts for collection.

LuminousMoth has created scheduled tasks to establish persistence for their tools.

APT42 has used scheduled tasks for persistence.

Fox Kitten has used Scheduled Tasks for persistence and to load and execute a reverse proxy binary.

APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google.

Lazarus Group has used schtasks for persistence including through the periodic execution of a remote XSL script or a dropped VBS payload.

Earth Lusca used the command schtasks /Create /SC ONLOgon /TN WindowsUpdateCheck /TR “[file path]” /ru system for persistence.

Silence has used scheduled tasks to stage its operation.

Cobalt Group has created Windows tasks to establish persistence.

Wizard Spider has used scheduled tasks to establish persistence for TrickBot and other malware.

Molerats has created scheduled tasks to persistently run VBScripts.

Moonstone Sleet used scheduled tasks for program execution during initial access to victim machines.

HEXANE has used a scheduled task to establish persistence for a keylogger.

Daggerfly has attempted to use scheduled tasks for persistence in victim environments.

Rancor launched a scheduled task to gain persistence using the schtasks /create /sc command.

Magic Hound has used scheduled tasks to establish persistence and execution.

APT33 has created a scheduled task to execute a .vbe file multiple times a day.

FIN10 has established persistence by using S4U tasks as well as the Scheduled Task option in PowerShell Empire.

FIN8 has used scheduled tasks to maintain RDP backdoors.

FIN13 has created scheduled tasks in the `C:\Windows` directory of the compromised network.

APT38 has injected malicious payloads into the `explorer.exe` process.

BlackByte has injected Cobalt Strike into `wuauclt.exe` during intrusions. BlackByte has injected ransomware into `svchost.exe` before encryption.

Kimsuky has used Win7Elevate to inject malicious code into explorer.exe.

APT41 malware TIDYELF loaded the main WINTERLOVE component by injecting it into the iexplore.exe process.

APT32 malware has injected a Cobalt Strike beacon into Rundll32.exe.

Gamaredon Group has injected Remcos into explorer.exe.