Procedure examples

Wizard Spider has used scheduled tasks to establish persistence for TrickBot and other malware.

Molerats has created scheduled tasks to persistently run VBScripts.

Moonstone Sleet used scheduled tasks for program execution during initial access to victim machines.

HEXANE has used a scheduled task to establish persistence for a keylogger.

Daggerfly has attempted to use scheduled tasks for persistence in victim environments.

Rancor launched a scheduled task to gain persistence using the schtasks /create /sc command.

Magic Hound has used scheduled tasks to establish persistence and execution.

APT33 has created a scheduled task to execute a .vbe file multiple times a day.

FIN10 has established persistence by using S4U tasks as well as the Scheduled Task option in PowerShell Empire.

FIN8 has used scheduled tasks to maintain RDP backdoors.

FIN13 has created scheduled tasks in the `C:\Windows` directory of the compromised network.

TrickBot creates a scheduled task on the system that provides persistence.

Bumblebee can achieve persistence by copying its DLL to a subdirectory of %APPDATA% and creating a Visual Basic Script that will load the DLL via a scheduled task.

GRIFFON has used sctasks for persistence.

yty establishes persistence by creating a scheduled task with the command SchTasks /Create /SC DAILY /TN BigData /TR “ + path_file + “/ST 09:30“.

Stuxnet schedules a network job to execute two minutes after host infection.

POWRUNER persists through a scheduled task that executes it every minute.

SharpStage has a persistence component to write a scheduled task for the payload.

Smoke Loader launches a scheduled task.

Matryoshka can establish persistence by adding a Scheduled Task named "Microsoft Boost Kernel Optimization".

GravityRAT creates a scheduled task to ensure it is re-executed everyday.

Prestige has been executed on a target system through a scheduled task created by Sandworm Team using Impacket.

SharpDisco can create scheduled tasks to execute reverse shells that read and write data to and from specified SMB shares.

TONESHELL has created scheduled tasks to maintain persistence.

RainyDay can use scheduled tasks to achieve persistence.

NETWIRE can create a scheduled task to establish persistence.

Bad Rabbit’s infpub.dat file creates a scheduled task to launch a malicious executable.

CosmicDuke uses scheduled tasks typically named "Watchmon Service" for persistence.

IMAPLoader creates scheduled tasks for persistence based on the operating system version of the victim machine.

Emotet has maintained persistence through a scheduled task, e.g. though a .dll file in the Registry.

Tomiris has used `SCHTASKS /CREATE /SC DAILY /TN StartDVL /TR "[path to self]" /ST 10:00` to establish persistence.

BADHATCH can use `schtasks.exe` to gain persistence.

The different components of Machete are executed by Windows Task Scheduler.

PUBLOAD has created scheduled tasks to maintain persistence with the command `schtasks.exe /F /Create /TN Microsoft_Licensing /sc minute /MO 1 /TR C:\\Users\\Public\\Libraries\...`

SystemBC has executed a copy of itself as a scheduled task with the `start` command. The copy of SystemBC has random file and directory names within the ProgramData directory.

InvisiMole has used scheduled tasks named MSST and \Microsoft\Windows\Autochk\Scheduled to establish persistence.

CLAIMLOADER has created scheduled tasks that execute the loader every five(5) minutes using `schtasks /F /Create /TN \"<fake_software_name>\" /SC minute /MO 5 /TR
\"C:\\ProgramData\\<path_to_exe> <hardcoded_argument>\`.

Apostle achieves persistence by creating a scheduled task, such as MicrosoftCrashHandlerUAC.

Okrum's installer can attempt to achieve persistence by creating a scheduled task.

SameCoin has the ability to set a scheduled task for execution.

RemoteCMD can execute commands remotely by creating a new schedule task on the remote system

IcedID has created a scheduled task to establish persistence.

Nightdoor uses scheduled tasks for persistence to load the final malware payload into memory.

CHIMNEYSWEEP can use the Windows `SilentCleanup` scheduled task to enable payload execution.

Lucifer has established persistence by creating the following scheduled task schtasks /create /sc minute /mo 1 /tn QQMusic ^ /tr C:Users\%USERPROFILE%\Downloads\spread.exe /F.

zwShell has used SchTasks for execution.

NotPetya creates a task to reboot the system one hour after infection.

ISMInjector creates scheduled tasks to establish persistence.

GoldMax has used scheduled tasks to maintain persistence.

Anchor can create a scheduled task for persistence.