Procedure examples

Pteranodon schedules tasks to invoke its components in order to establish persistence.

DarkWatchman has created a scheduled task for persistence.

Dyre has the ability to achieve persistence by adding a new task in the task scheduler to run every minute.

PlugX has created a scheduled task to execute additional malicious software, as well as maintain persistence.

MultiLayer Wiper creates a malicious scheduled task that launches a batch file to remove Windows Event Logs.

Remsec schedules the execution one of its modules by creating a new scheduler task.

PureCrypter can maintain persistence with scheduled tasks.

SVCReady can create a scheduled task named `RecoveryExTask` to gain persistence.

Gazer can establish persistence by creating a scheduled task.

Latrodectus can create scheduled tasks for persistence.

Saint Bot has created a scheduled task named "Maintenance" to establish persistence.

MuddyViper has the ability to establish persistence by creating a scheduled task named ManageOnDriveUpdater to launch itself during system startup.

QUADAGENT creates a scheduled task to maintain persistence on the victim’s machine.

Spica has created a scheduled task named `CalendarChecker` to establish persistence.

Embargo has obtained persistence of the loader MDeployer by creating a scheduled task named “Perf_sys.”

MagicRAT can persist via scheduled tasks.

Shamoon copies an executable payload to the target system by using SMB/Windows Admin Shares and then scheduling an unnamed task to execute the malware.

JHUHUGIT has registered itself as a scheduled task to run each time the current user logs in.

RedLine Stealer has achieved persistence via scheduled tasks.

OopsIE creates a scheduled task to run itself every three minutes.

Attor's installer plugin can schedule a new task that loads the dispatcher on boot/logon.

SQLRat has created scheduled tasks in %appdata%\Roaming\Microsoft\Templates\.

LitePower can create a scheduled task to enable persistence mechanisms.

Crutch has the ability to persist using scheduled tasks.

RTM tries to add a scheduled task to establish persistence.

BlackByte Ransomware creates a schedule task to execute remotely deployed ransomware payloads.

Sibot has been executed via a scheduled task.

ZxxZ has used scheduled tasks for persistence and execution.

Tarrask is able to create “hidden” scheduled tasks for persistence.

Bazar can create a scheduled task for persistence.

SUGARDUMP has created scheduled tasks called `MicrosoftInternetExplorerCrashRepoeterTaskMachineUA` and `MicrosoftEdgeCrashRepoeterTaskMachineUA`, which were configured to execute `CrashReporter.exe` during user logon.

XLoader can create scheduled tasks for persistence.

HiddenFace has used scheduled tasks for execution and persistence.

CorKLOG has achieved persistence through the creation of a scheduled task named TableInputServices by using the command `schtasks /create /tn TabletlnputServices /tr /sc minute /mo 10 /f`.

Ryuk can remotely create a scheduled task to execute itself on a system.

HermeticWiper has the ability to use scheduled tasks for execution.

ccf32 can run on a daily basis using a scheduled task.

Kapeka persists via scheduled tasks.

LockBit 2.0 can be executed via scheduled task.

Zebrocy has a command to create a scheduled task for persistence.

EvilBunny has executed commands via scheduled tasks.

HotCroissant has attempted to install a scheduled task named “Java Maintenance64” on startup to establish persistence.

ServHelper contains modules that will use schtasks to carry out malicious operations.

Valak has used scheduled tasks to execute additional payloads and to gain persistence on a compromised host.

Milan can establish persistence on a targeted host with scheduled tasks.

Carbon creates several tasks for later execution to continue persistence on the victim’s machine.

DanBot can use a scheduled task for installation.

Solar can create scheduled tasks named Earth and Venus, which run every 30 and 40 seconds respectively, to support C2 and exfiltration.

Ramsay can schedule tasks via the Windows COM API to maintain persistence.

AshTag can set persistence using scheduled tasks.