Procedure examples

APT38 has used Task Scheduler to run programs at system startup or on a scheduled basis for persistence. Additionally, APT38 has used living-off-the-land scripts to execute a malicious script via a scheduled task.

BlackByte created scheduled tasks for payload execution.

GALLIUM established persistence for PoisonIvy by created a scheduled task.

An APT3 downloader creates persistence by creating the following scheduled task: schtasks /create /tn "mysc" /tr C:\Users\Public\test.exe /sc ONLOGON /ru "System".

Kimsuky has downloaded additional malware with scheduled tasks. Kimsuky has established persistence by creating a scheduled task named “ChromeUpdateTaskMachine” through the PowerShell cmdlet `Register-ScheduleTask` which was set to execute another PowerShell script once, then five minutes after its creation and periodically repeat every 30 minutes. Kimsuky has also set scheduled tasks that run periodically using the PT1M repetition pattern leveraging naming conventions of Anti-Virus software to include "AhnlabUpdate".

A Patchwork file stealer can run a TaskScheduler DLL to add persistence.

APT41 used a compromised account to create a scheduled task on a system.

Dragonfly has used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files.

menuPass has used a script (atexec.py) to execute a command on a target machine via Task Scheduler.

APT32 has used scheduled tasks to persist on victim systems.

MuddyWater has used scheduled tasks to establish persistence.

Naikon has used schtasks.exe for lateral movement in compromised networks.

FIN6 has used scheduled tasks to establish persistence for various malware it uses, including downloaders known as HARDTACK and SHIPBREAD and FrameworkPOS.

Gamaredon Group has created scheduled tasks to launch executables after a designated number of minutes have passed.

FIN7 malware has created scheduled tasks to establish persistence. Specifically, FIN7 has used OpenSSH to establish persistence.

Sandworm Team leveraged SHARPIVORY, a .NET dropper that writes embedded payload to disk and uses scheduled tasks to persist on victim machines.

Machete has created scheduled tasks to maintain Machete's persistence.

Mustang Panda has created a scheduled task to execute additional malicious software, as well as maintain persistence. Mustang Panda has also created a scheduled task that creates a reverse shell.

APT39 has created scheduled tasks for persistence.

TA2541 has used scheduled tasks to establish persistence for installed tools.

APT37 has created scheduled tasks to run malicious scripts on a compromised host.

OilRig has created scheduled tasks that run a VBScript to execute a payload on victim machines.

Higaisa dropped and added officeupdate.exe to scheduled tasks.

Confucius has created scheduled tasks to maintain persistence on a compromised host.

Blue Mockingbird has used Windows Scheduled Tasks to establish persistence on local and remote hosts.

Winter Vivern executed PowerShell scripts that would subsequently attempt to establish persistence by creating scheduled tasks objects to periodically retrieve and execute remotely-hosted payloads.

Storm-0501 had used a scheduled task named “SysUpdate” that was registered via GPO on devices in the network to distribute the Embargo ransomware.

BITTER has used scheduled tasks for persistence and execution.

RedCurl has created scheduled tasks for persistence.

Stealth Falcon malware creates a scheduled task entitled “IE Web Cache” to execute a malicious file hourly.

APT29 has used named and hijacked scheduled tasks to establish persistence.

Chimera has used scheduled tasks to invoke Cobalt Strike including through batch script schtasks /create /ru "SYSTEM" /tn "update" /tr "cmd /c c:\windows\temp\update.bat" /sc once /f /st and to maintain persistence.

BRONZE BUTLER has used schtasks to register a scheduled task to execute malware during lateral movement.

Ember Bear uses remotely scheduled tasks to facilitate remote command execution on victim machines.

ToddyCat has used scheduled tasks to execute discovery commands and scripts for collection.

LuminousMoth has created scheduled tasks to establish persistence for their tools.

APT42 has used scheduled tasks for persistence.

Fox Kitten has used Scheduled Tasks for persistence and to load and execute a reverse proxy binary.

APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google.

Lazarus Group has used schtasks for persistence including through the periodic execution of a remote XSL script or a dropped VBS payload.

Earth Lusca used the command schtasks /Create /SC ONLOgon /TN WindowsUpdateCheck /TR “[file path]” /ru system for persistence.

Silence has used scheduled tasks to stage its operation.

Cobalt Group has created Windows tasks to establish persistence.

Wizard Spider has used scheduled tasks to establish persistence for TrickBot and other malware.

Molerats has created scheduled tasks to persistently run VBScripts.

Moonstone Sleet used scheduled tasks for program execution during initial access to victim machines.

HEXANE has used a scheduled task to establish persistence for a keylogger.

Daggerfly has attempted to use scheduled tasks for persistence in victim environments.

Rancor launched a scheduled task to gain persistence using the schtasks /create /sc command.

Magic Hound has used scheduled tasks to establish persistence and execution.