Procedure examples

During Operation Dream Job, Lazarus Group created scheduled tasks to set a periodic execution of a remote XSL script.

During SharePoint ToolShell Exploitation, threat actors used scheduled tasks to help establish persistence.

During Frankenstein, the threat actors established persistence through a scheduled task using the command: `/Create /F /SC DAILY /ST 09:00 /TN WinUpdate /TR`, named "WinUpdate"

In the Triton Safety Instrumented System Attack, TEMP.Veles installed scheduled tasks defined in XML files.

During Juicy Mix, OilRig used VBS droppers to schedule tasks for persistence.

During the C0032 campaign, TEMP.Veles used scheduled task XML triggers.

During the SolarWinds Compromise, APT29 used `scheduler` and `schtasks` to create new tasks on remote host as part of their lateral movement. They manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration. APT29 also created a scheduled task to maintain SUNSPOT persistence when the host booted.

During Operation CuckooBees, the threat actors used scheduled tasks to execute batch scripts for lateral movement with the following command: `SCHTASKS /Create /S <IP Address> /U <Username> /p <Password> /SC ONCE /TN test /TR <Path to a Batch File> /ST <Time> /RU SYSTEM.`

During Operation Wocao, threat actors used scheduled tasks to execute malicious PowerShell code on remote systems.

During C0017, APT41 used the following Windows scheduled tasks for DEADEYE dropper persistence on US state government networks: `\Microsoft\Windows\PLA\Server Manager Performance Monitor`, `\Microsoft\Windows\Ras\ManagerMobility`, `\Microsoft\Windows\WDI\SrvSetupResults`, and `\Microsoft\Windows\WDI\USOShared`.

During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.

During CostaRicto, the threat actors used scheduled tasks to download backdoor tools.