Procedure examples

HiddenFace has used scheduled tasks for execution and persistence.

CorKLOG has achieved persistence through the creation of a scheduled task named TableInputServices by using the command `schtasks /create /tn TabletlnputServices /tr /sc minute /mo 10 /f`.

Ryuk can remotely create a scheduled task to execute itself on a system.

HermeticWiper has the ability to use scheduled tasks for execution.

ccf32 can run on a daily basis using a scheduled task.

Kapeka persists via scheduled tasks.

LockBit 2.0 can be executed via scheduled task.

Zebrocy has a command to create a scheduled task for persistence.

EvilBunny has executed commands via scheduled tasks.

HotCroissant has attempted to install a scheduled task named “Java Maintenance64” on startup to establish persistence.

ServHelper contains modules that will use schtasks to carry out malicious operations.

Valak has used scheduled tasks to execute additional payloads and to gain persistence on a compromised host.

Milan can establish persistence on a targeted host with scheduled tasks.

Carbon creates several tasks for later execution to continue persistence on the victim’s machine.

DanBot can use a scheduled task for installation.

Solar can create scheduled tasks named Earth and Venus, which run every 30 and 40 seconds respectively, to support C2 and exfiltration.

Ramsay can schedule tasks via the Windows COM API to maintain persistence.

AshTag can set persistence using scheduled tasks.

Revenge RAT schedules tasks to run malicious scripts at different intervals.

BackConfig has the ability to use scheduled tasks to repeatedly execute malicious payloads on a compromised host.

Mango can create a scheduled task to run every 32 seconds to communicate with C2 and execute received commands.

GrimAgent has the ability to set persistence using the Task Scheduler.

Lokibot embedded the commands schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I inside a batch script.

BabyShark has used scheduled tasks to maintain persistence.

BONDUPDATER persists using a scheduled task that executes every minute.

Meteor execution begins from a scheduled task named `Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeAll` and it creates a separate scheduled task called `mstask` to run the wiper only once at 23:55:00.

Maze has created scheduled tasks using name variants such as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update", to launch Maze at a specific time.

ComRAT has used a scheduled task to launch its PowerShell loader.

Disco can create a scheduled task to run every minute for persistence.

Qilin has pushed scheduled tasks via Group Policy Objects (GPOs) for execution. Qilin has also created a scheduled task named TVInstallRestore, configured to run at logon using the `/SC ONLOGON` argument.

AppleJeus has created a scheduled SYSTEM task that runs when a user logs in.

SoreFang can gain persistence through use of scheduled tasks.

One persistence mechanism used by CozyCar is to register itself as a scheduled task.

Agent Tesla has achieved persistence via scheduled tasks.

POWERSTATS has established persistence through a scheduled task using the command ”C:\Windows\system32\schtasks.exe” /Create /F /SC DAILY /ST 12:00 /TN MicrosoftEdge /TR “c:\Windows\system32\wscript.exe C:\Windows\temp\Windows.vbe”.

BADNEWS creates a scheduled task to establish by executing a malicious payload every subsequent minute.

Goopy has the ability to maintain persistence by creating scheduled tasks set to run every hour.

Remexi utilizes scheduled tasks as a persistence mechanism.

QakBot has the ability to create scheduled tasks for persistence.

Helminth has used a scheduled task for persistence.

Dridex can maintain persistence via the creation of scheduled tasks within system directories such as `windows\system32\`, `windows\syswow64,` `winnt\system32`, and `winnt\syswow64`.

JSS Loader has the ability to launch scheduled tasks to establish persistence.

StrifeWater has create a scheduled task named `Mozilla\Firefox Default Browser Agent 409046Z0FF4A39CB` for persistence.

PowerSploit's New-UserPersistenceOption Persistence argument can be used to establish via a Scheduled Task/Job.

Empire has modules to interact with the Windows task scheduler.

CSPY Downloader can use the schtasks utility to bypass UAC.

AsyncRAT can create a scheduled task to maintain persistence on system start-up.

MCMD can use scheduled tasks for persistence.

IronNetInjector has used a task XML file named mssch.xml to run an IronPython script when a user logs in or when specific system events are created.

Koadic has used scheduled tasks to add persistence.