Procedure examples

Revenge RAT schedules tasks to run malicious scripts at different intervals.

BackConfig has the ability to use scheduled tasks to repeatedly execute malicious payloads on a compromised host.

Mango can create a scheduled task to run every 32 seconds to communicate with C2 and execute received commands.

GrimAgent has the ability to set persistence using the Task Scheduler.

Lokibot embedded the commands schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I inside a batch script.

BabyShark has used scheduled tasks to maintain persistence.

BONDUPDATER persists using a scheduled task that executes every minute.

Meteor execution begins from a scheduled task named `Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeAll` and it creates a separate scheduled task called `mstask` to run the wiper only once at 23:55:00.

Maze has created scheduled tasks using name variants such as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update", to launch Maze at a specific time.

ComRAT has used a scheduled task to launch its PowerShell loader.

Disco can create a scheduled task to run every minute for persistence.

Qilin has pushed scheduled tasks via Group Policy Objects (GPOs) for execution. Qilin has also created a scheduled task named TVInstallRestore, configured to run at logon using the `/SC ONLOGON` argument.

AppleJeus has created a scheduled SYSTEM task that runs when a user logs in.

SoreFang can gain persistence through use of scheduled tasks.

One persistence mechanism used by CozyCar is to register itself as a scheduled task.

Agent Tesla has achieved persistence via scheduled tasks.

POWERSTATS has established persistence through a scheduled task using the command ”C:\Windows\system32\schtasks.exe” /Create /F /SC DAILY /ST 12:00 /TN MicrosoftEdge /TR “c:\Windows\system32\wscript.exe C:\Windows\temp\Windows.vbe”.

BADNEWS creates a scheduled task to establish by executing a malicious payload every subsequent minute.

Goopy has the ability to maintain persistence by creating scheduled tasks set to run every hour.

Remexi utilizes scheduled tasks as a persistence mechanism.

QakBot has the ability to create scheduled tasks for persistence.

Helminth has used a scheduled task for persistence.

Dridex can maintain persistence via the creation of scheduled tasks within system directories such as `windows\system32\`, `windows\syswow64,` `winnt\system32`, and `winnt\syswow64`.

JSS Loader has the ability to launch scheduled tasks to establish persistence.

StrifeWater has create a scheduled task named `Mozilla\Firefox Default Browser Agent 409046Z0FF4A39CB` for persistence.

PowerSploit's New-UserPersistenceOption Persistence argument can be used to establish via a Scheduled Task/Job.

Empire has modules to interact with the Windows task scheduler.

CSPY Downloader can use the schtasks utility to bypass UAC.

AsyncRAT can create a scheduled task to maintain persistence on system start-up.

MCMD can use scheduled tasks for persistence.

IronNetInjector has used a task XML file named mssch.xml to run an IronPython script when a user logs in or when specific system events are created.

Koadic has used scheduled tasks to add persistence.

schtasks is used to schedule tasks on a Windows system to run at a specific date and time.

QuasarRAT contains a .NET wrapper DLL for creating and managing scheduled tasks for maintaining persistence upon reboot.

Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.

Mini Shai-Hulud has obtained persistence on Linux devices by writing the `gh-token-monitor` daemon within `~/.config/systemd/user/gh-token-monitor.service` that polls GitHub every 60 seconds. Mini Shai-Hulud has also leveraged a daemon called “kitty-monitor.service” to maintain persistence within Linux hosts.

CanisterWorm has registered itself as a systemd service for persistence on targeted Kubernetes nodes.

During RedPenguin, UNC3886 exploited CVE-2025-21590 to enable malicious code injection into the memory of legitimate processes.

During Operation Sharpshooter, threat actors leveraged embedded shellcode to inject a downloader into the memory of Word.

During the 2015 Ukraine Electric Power Attack, Sandworm Team loaded BlackEnergy into svchost.exe, which then launched iexplore.exe for their C2.

During the 3CX Supply Chain Attack, AppleJeus's VEILEDSIGNAL uses process injection to inject the C2 communication module code in the first found process instance of Chrome, Firefox, or Edge web browsers. It also monitors the established named pipe and re-injects the C2 communication module if necessary.

During Cutting Edge, threat actors used malicious SparkGateway plugins to inject shared objects into web process memory on compromised Ivanti Secure Connect VPNs to enable deployment of backdoors.

ArcaneDoor included injecting code into the AAA and Crash Dump processes on infected Cisco ASA devices.

During Operation Wocao, threat actors injected code into a selected process, which in turn launches a command as a child process of the original.

APT38 has injected malicious payloads into the `explorer.exe` process.

BlackByte has injected Cobalt Strike into `wuauclt.exe` during intrusions. BlackByte has injected ransomware into `svchost.exe` before encryption.

Kimsuky has used Win7Elevate to inject malicious code into explorer.exe.

APT41 malware TIDYELF loaded the main WINTERLOVE component by injecting it into the iexplore.exe process.

APT32 malware has injected a Cobalt Strike beacon into Rundll32.exe.

Gamaredon Group has injected Remcos into explorer.exe.