Procedure examples

During the C0032 campaign, TEMP.Veles used scheduled task XML triggers.

During the SolarWinds Compromise, APT29 used `scheduler` and `schtasks` to create new tasks on remote host as part of their lateral movement. They manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration. APT29 also created a scheduled task to maintain SUNSPOT persistence when the host booted.

During Operation CuckooBees, the threat actors used scheduled tasks to execute batch scripts for lateral movement with the following command: `SCHTASKS /Create /S <IP Address> /U <Username> /p <Password> /SC ONCE /TN test /TR <Path to a Batch File> /ST <Time> /RU SYSTEM.`

During Operation Wocao, threat actors used scheduled tasks to execute malicious PowerShell code on remote systems.

During C0017, APT41 used the following Windows scheduled tasks for DEADEYE dropper persistence on US state government networks: `\Microsoft\Windows\PLA\Server Manager Performance Monitor`, `\Microsoft\Windows\Ras\ManagerMobility`, `\Microsoft\Windows\WDI\SrvSetupResults`, and `\Microsoft\Windows\WDI\USOShared`.

During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.

During CostaRicto, the threat actors used scheduled tasks to download backdoor tools.

APT38 has used Task Scheduler to run programs at system startup or on a scheduled basis for persistence. Additionally, APT38 has used living-off-the-land scripts to execute a malicious script via a scheduled task.

BlackByte created scheduled tasks for payload execution.

GALLIUM established persistence for PoisonIvy by created a scheduled task.

An APT3 downloader creates persistence by creating the following scheduled task: schtasks /create /tn "mysc" /tr C:\Users\Public\test.exe /sc ONLOGON /ru "System".

Kimsuky has downloaded additional malware with scheduled tasks. Kimsuky has established persistence by creating a scheduled task named “ChromeUpdateTaskMachine” through the PowerShell cmdlet `Register-ScheduleTask` which was set to execute another PowerShell script once, then five minutes after its creation and periodically repeat every 30 minutes. Kimsuky has also set scheduled tasks that run periodically using the PT1M repetition pattern leveraging naming conventions of Anti-Virus software to include "AhnlabUpdate".

A Patchwork file stealer can run a TaskScheduler DLL to add persistence.

APT41 used a compromised account to create a scheduled task on a system.

Dragonfly has used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files.

menuPass has used a script (atexec.py) to execute a command on a target machine via Task Scheduler.

APT32 has used scheduled tasks to persist on victim systems.

MuddyWater has used scheduled tasks to establish persistence.

Naikon has used schtasks.exe for lateral movement in compromised networks.

FIN6 has used scheduled tasks to establish persistence for various malware it uses, including downloaders known as HARDTACK and SHIPBREAD and FrameworkPOS.

Gamaredon Group has created scheduled tasks to launch executables after a designated number of minutes have passed.

FIN7 malware has created scheduled tasks to establish persistence. Specifically, FIN7 has used OpenSSH to establish persistence.

Sandworm Team leveraged SHARPIVORY, a .NET dropper that writes embedded payload to disk and uses scheduled tasks to persist on victim machines.

Machete has created scheduled tasks to maintain Machete's persistence.

Mustang Panda has created a scheduled task to execute additional malicious software, as well as maintain persistence. Mustang Panda has also created a scheduled task that creates a reverse shell.

APT39 has created scheduled tasks for persistence.

TA2541 has used scheduled tasks to establish persistence for installed tools.

APT37 has created scheduled tasks to run malicious scripts on a compromised host.

OilRig has created scheduled tasks that run a VBScript to execute a payload on victim machines.

Higaisa dropped and added officeupdate.exe to scheduled tasks.

Confucius has created scheduled tasks to maintain persistence on a compromised host.

Blue Mockingbird has used Windows Scheduled Tasks to establish persistence on local and remote hosts.

Winter Vivern executed PowerShell scripts that would subsequently attempt to establish persistence by creating scheduled tasks objects to periodically retrieve and execute remotely-hosted payloads.

Storm-0501 had used a scheduled task named “SysUpdate” that was registered via GPO on devices in the network to distribute the Embargo ransomware.

BITTER has used scheduled tasks for persistence and execution.

RedCurl has created scheduled tasks for persistence.

Stealth Falcon malware creates a scheduled task entitled “IE Web Cache” to execute a malicious file hourly.

APT29 has used named and hijacked scheduled tasks to establish persistence.

Chimera has used scheduled tasks to invoke Cobalt Strike including through batch script schtasks /create /ru "SYSTEM" /tn "update" /tr "cmd /c c:\windows\temp\update.bat" /sc once /f /st and to maintain persistence.

BRONZE BUTLER has used schtasks to register a scheduled task to execute malware during lateral movement.

Ember Bear uses remotely scheduled tasks to facilitate remote command execution on victim machines.

ToddyCat has used scheduled tasks to execute discovery commands and scripts for collection.

LuminousMoth has created scheduled tasks to establish persistence for their tools.

APT42 has used scheduled tasks for persistence.

Fox Kitten has used Scheduled Tasks for persistence and to load and execute a reverse proxy binary.

APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google.

Lazarus Group has used schtasks for persistence including through the periodic execution of a remote XSL script or a dropped VBS payload.

Earth Lusca used the command schtasks /Create /SC ONLOgon /TN WindowsUpdateCheck /TR “[file path]” /ru system for persistence.

Silence has used scheduled tasks to stage its operation.

Cobalt Group has created Windows tasks to establish persistence.