T1053.005 Scheduled Task

About this technique

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

An adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence. The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and/or to run a process under the context of a specified account (such as SYSTEM). Similar to System Binary Proxy Execution, adversaries have also abused the Windows Task Scheduler to potentially mask one-time execution under signed/trusted system processes.

Adversaries may also create "hidden" scheduled tasks (i.e. Hide Artifacts) that may not be visible to defender tools and manual queries used to enumerate tasks. Specifically, an adversary may hide a task from `schtasks /query` and the Task Scheduler by deleting the associated Security Descriptor (SD) registry value (where deletion of this value must be completed using SYSTEM permissions). Adversaries may also employ alternate methods to hide tasks, such as altering the metadata (e.g., `Index` value) within associated registry keys.

Detection rules57

Rules on DetectionCode tagged with T1053.005.

Sigma31

Rule	Level	Log source
HackTool - Default PowerSploit/Empire Scheduled Task Creation	high	windows / process_creation
Important Scheduled Task Deleted/Disabled	high	windows / NULL
Persistence and Execution at Scale via GPO Scheduled Task	high	windows / NULL
Potential Persistence Via Powershell Search Order Hijacking - Task	high	windows / process_creation
Potential Registry Persistence Attempt Via Windows Telemetry	high	windows / registry_set
Potential SSH Tunnel Persistence Install Using A Scheduled Task	high	windows / process_creation
Renamed Schtasks Execution	high	windows / process_creation
Scheduled Task Creation Masquerading as System Processes	high	windows / process_creation
Scheduled Task Executing Encoded Payload from Registry	high	windows / process_creation
Scheduled TaskCache Change by Uncommon Program	high	windows / registry_set
Schtasks Creation Or Modification With SYSTEM Privileges	high	windows / process_creation
Schtasks From Suspicious Folders	high	windows / process_creation
Suspicious Command Patterns In Scheduled Task Creation	high	windows / process_creation
Suspicious Modification Of Scheduled Tasks	high	windows / process_creation
Suspicious Scheduled Task Creation	high	windows / NULL
Suspicious Scheduled Task Creation Involving Temp Folder	high	windows / process_creation
Suspicious Scheduled Task Update	high	windows / NULL
Suspicious Schtasks Execution AppData Folder	high	windows / process_creation
Suspicious Schtasks Schedule Types	high	windows / process_creation
Uncommon One Time Only Scheduled Task At 00:00	high	windows / process_creation
Potential Persistence Via Microsoft Compatibility Appraiser	medium	windows / process_creation
Powershell Create Scheduled Task	medium	windows / ps_script
Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE	medium	windows / process_creation
Scheduled Task Creation with Curl and PowerShell Execution Combo	medium	windows / process_creation
Scheduled Task Executed From A Suspicious Location	medium	windows / NULL
Scheduled Task Executed Uncommon LOLBIN	medium	windows / NULL
Scheduled Task Executing Payload from Registry	medium	windows / process_creation
Suspicious Scheduled Task Creation via Masqueraded XML File	medium	windows / process_creation
Suspicious Scheduled Task Name As GUID	medium	windows / process_creation
Suspicious Schtasks Schedule Type With High Privileges	medium	windows / process_creation
Scheduled Task Creation Via Schtasks.EXE	low	windows / process_creation

Splunk26

Rule	Type	Risk	Data source
Possible Lateral Movement PowerShell Spawn	Anomaly	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2
Randomly Generated Scheduled Task Name	Hunting	NULL	Windows Event Log Security 4698
Scheduled Task Deleted Or Created via CMD	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Scheduled Task Initiation on Remote Endpoint	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Scheduled tasks used in BadRabbit ransomware	TTP	NULL	Sysmon EventID 1
Schtasks scheduling job on remote system	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Schtasks used for forcing a reboot	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Short Lived Scheduled Task	Anomaly	NULL	Windows Event Log Security 4698, Windows Event Log Security 4699
Suspicious Scheduled Task from Public Directory	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Svchost LOLBAS Execution Process Spawn	TTP	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2
Windows Compatibility Telemetry Suspicious Child Process	TTP	NULL	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2
Windows Compatibility Telemetry Tampering Through Registry	TTP	NULL	Sysmon EventID 13
Windows Enable Win32 ScheduledJob via Registry	Anomaly	NULL	Sysmon EventID 13
Windows Error Report Created in ReportQueue Manually	Anomaly	NULL	Sysmon EventID 11
Windows PowerShell ScheduleTask	Anomaly	NULL	Powershell Script Block Logging 4104
Windows Registry Delete Task SD	Anomaly	NULL	Sysmon EventID 12
Windows Scheduled Task Created in a Group Policy Object	TTP	NULL	Windows Event Log Security 5145
Windows Scheduled Task Created Via XML	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Scheduled Task Service Spawned Shell	TTP	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2
Windows Scheduled Task with Highest Privileges	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Scheduled Task with Suspicious Command	TTP	NULL	Windows Event Log Security 4698, Windows Event Log Security 4700, Windows Event Log Security 4702
Windows Scheduled Task with Suspicious Name	TTP	NULL	Windows Event Log Security 4698, Windows Event Log Security 4700, Windows Event Log Security 4702
Windows Schtasks Create Run As System	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
WinEvent Scheduled Task Created to Spawn Shell	TTP	NULL	Windows Event Log Security 4698
WinEvent Scheduled Task Created Within Public Path	TTP	NULL	Windows Event Log Security 4698
WinEvent Windows Task Scheduler Event Action Started	Hunting	NULL	Windows Event Log TaskScheduler 200, Windows Event Log TaskScheduler 201

Groups54

Show 30 more

Software124

Show 100 more

Campaigns12

2022 Ukraine Electric Power Attack C0017 C0032 CostaRicto Frankenstein Juicy Mix Operation CuckooBees Operation Dream Job Operation Wocao SharePoint ToolShell Exploitation SolarWinds Compromise Triton Safety Instrumented System Attack

Procedure examples190

Groups54

Used by	Procedure example
GroupAPT-C-36	APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google. QiAnXin APT-C-36 Feb2019
GroupAPT29	APT29 has used named and hijacked scheduled tasks to establish persistence. Mandiant No Easy Breach
GroupAPT3	An APT3 downloader creates persistence by creating the following scheduled task: `schtasks /create /tn "mysc" /tr C:\Users\Public\test.exe /sc ONLOGON /ru "System"`. FireEye Operation Double Tap
GroupAPT32	APT32 has used scheduled tasks to persist on victim systems. Cybereason Cobalt Kitty 2017 Cybereason Oceanlotus May 2017 ESET OceanLotus Mar 2019 FireEye APT32 May 2017
GroupAPT33	APT33 has created a scheduled task to execute a .vbe file multiple times a day. Symantec Elfin Mar 2019
GroupAPT37	APT37 has created scheduled tasks to run malicious scripts on a compromised host. Volexity InkySquid RokRAT August 2021
GroupAPT38	APT38 has used Task Scheduler to run programs at system startup or on a scheduled basis for persistence. Additionally, APT38 has used living-off-the-land scripts to execute a malicious script via a scheduled task. 1 - appv CISA AA20-239A BeagleBoyz August 2020
GroupAPT39	APT39 has created scheduled tasks for persistence. BitDefender Chafer May 2020 FBI FLASH APT39 September 2020 FireEye APT39 Jan 2019

View all 54 groups examples

Software124

Used by	Procedure example
MalwareAgent Tesla	Agent Tesla has achieved persistence via scheduled tasks. SentinelLabs Agent Tesla Aug 2020
MalwareAnchor	Anchor can create a scheduled task for persistence. Cyberreason Anchor December 2019
MalwareApostle	Apostle achieves persistence by creating a scheduled task, such as `MicrosoftCrashHandlerUAC`. SentinelOne Agrius 2021
MalwareAppleJeus	AppleJeus has created a scheduled SYSTEM task that runs when a user logs in. CISA AppleJeus Feb 2021
MalwareAshTag	AshTag can set persistence using scheduled tasks. Palo Alto Ashen Lepus DEC 2025
ToolAsyncRAT	AsyncRAT can create a scheduled task to maintain persistence on system start-up. Telefonica Snip3 December 2021
MalwareAttor	Attor's installer plugin can schedule a new task that loads the dispatcher on boot/logon. ESET Attor Oct 2019
MalwareBabyShark	BabyShark has used scheduled tasks to maintain persistence. Crowdstrike GTR2020 Mar 2020

View all 124 software examples

Campaigns12

Used by	Procedure example
Campaign2022 Ukraine Electric Power Attack	During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time. Mandiant-Sandworm-Ukraine-2022
CampaignC0017	During C0017, APT41 used the following Windows scheduled tasks for DEADEYE dropper persistence on US state government networks: `\Microsoft\Windows\PLA\Server Manager Performance Monitor`, `\Microsoft\Windows\Ras\ManagerMobility`, `\Microsoft\Windows\WDI\SrvSetupResults`, and `\Microsoft\Windows\WDI\USOShared`. Mandiant APT41
CampaignC0032	During the C0032 campaign, TEMP.Veles used scheduled task XML triggers. FireEye TRITON 2019
CampaignCostaRicto	During CostaRicto, the threat actors used scheduled tasks to download backdoor tools. BlackBerry CostaRicto November 2020
CampaignFrankenstein	During Frankenstein, the threat actors established persistence through a scheduled task using the command: `/Create /F /SC DAILY /ST 09:00 /TN WinUpdate /TR`, named "WinUpdate" Talos Frankenstein June 2019
CampaignJuicy Mix	During Juicy Mix, OilRig used VBS droppers to schedule tasks for persistence. ESET OilRig Campaigns Sep 2023
CampaignOperation CuckooBees	During Operation CuckooBees, the threat actors used scheduled tasks to execute batch scripts for lateral movement with the following command: `SCHTASKS /Create /S <IP Address> /U <Username> /p <Password> /SC ONCE /TN test /TR <Path to a Batch File> /ST <Time> /RU SYSTEM.` Cybereason OperationCuckooBees May 2022
CampaignOperation Dream Job	During Operation Dream Job, Lazarus Group created scheduled tasks to set a periodic execution of a remote XSL script. ESET Lazarus Jun 2020

View all 12 campaigns examples

References6

Defending Against Scheduled Task Attacks in Windows Environments Open source
Harshal Tupsamudre. (2022, June 20). Defending Against Scheduled Tasks. Retrieved July 5, 2022.
ProofPoint Serpent Open source
Campbell, B. et al. (2022, March 21). Serpent, No Swiping! New Backdoor Targets French Entities with Unique Attack Chain. Retrieved April 11, 2022.
Red Canary - Atomic Red Team Open source
Red Canary - Atomic Red Team. (n.d.). T1053.005 - Scheduled Task/Job: Scheduled Task. Retrieved June 19, 2024.
SigmaHQ Open source
Sittikorn S. (2022, April 15). Removal Of SD Value to Hide Schedule Task - Registry. Retrieved June 1, 2022.
Stack Overflow Open source
Stack Overflow. (n.d.). How to find the location of the Scheduled Tasks folder. Retrieved June 19, 2024.
Tarrask scheduled task Open source
Microsoft Threat Intelligence Team & Detection and Response Team . (2022, April 12). Tarrask malware uses scheduled tasks for defense evasion. Retrieved June 1, 2022.