Scheduled Task/Job: Scheduled Task

Anchor can create a scheduled task for persistence.^[1]

APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google.^[2]

APT29 used named and hijacked scheduled tasks to establish persistence.^[3]

An APT3 downloader creates persistence by creating the following scheduled task: schtasks /create /tn "mysc" /tr C:\Users\Public\test.exe /sc ONLOGON /ru "System".^[4]

APT32 has used scheduled tasks to persist on victim systems.^[5][6][7][8]

APT33 has created a scheduled task to execute a .vbe file multiple times a day.^[9]

APT39 has created scheduled tasks for persistence. ^[10][11]

APT41 used a compromised account to create a scheduled task on a system.^[12]

Attor's installer plugin can schedule a new task that loads the dispatcher on boot/logon.^[13]

BackConfig has the ability to use scheduled tasks to repeatedly execute malicious payloads on a compromised host.^[14]

BADNEWS creates a scheduled task to establish by executing a malicious payload every subsequent minute.^[15]

Blue Mockingbird has used Windows Scheduled Tasks to establish persistence on local and remote hosts.^[16]

BONDUPDATER persists using a scheduled task that executes every minute.^[17]

BRONZE BUTLER has used schtasks to register a scheduled task to execute malware during lateral movement.^[18]

Carbon creates several tasks for later execution to continue persistence on the victim’s machine.^[19]

Chimera has used scheduled tasks to invoke Cobalt Strike and maintain persistence.^[20]

Cobalt Group has created Windows tasks to establish persistence.^[21]

ComRAT has used a scheduled task to launch its PowerShell loader.^[22]

CosmicDuke uses scheduled tasks typically named "Watchmon Service" for persistence.^[23]

One persistence mechanism used by CozyCar is to register itself as a scheduled task.^[24]

Dragonfly 2.0 used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files.^[25][26]

Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.^[27]

Dyre has the ability to achieve persistence by adding a new task in the task scheduler to run every minute.^[28]

Emotet has maintained persistence through a scheduled task. ^[29]

Empire has modules to interact with the Windows task scheduler.^[30]

EvilBunny has executed commands via scheduled tasks.^[31]

FIN10 has established persistence by using S4U tasks as well as the Scheduled Task option in PowerShell Empire.^[32][30]

FIN6 has used scheduled tasks to establish persistence for various malware it uses, including downloaders known as HARDTACK and SHIPBREAD and FrameworkPOS.^[33]

FIN7 malware has created scheduled tasks to establish persistence.^{[34][35][36][37]}

FIN8 has used scheduled tasks to maintain RDP backdoors.^[38]

Frankenstein has established persistence through a scheduled task using the command: /Create /F /SC DAILY /ST 09:00 /TN WinUpdate /TR , named "WinUpdate".^[39]

Gamaredon Group has created a scheduled task to launch an executable every 10 minutes.^[40]

Gazer can establish persistence by creating a scheduled task.^[41][42]

Goopy has the ability to maintain persistence by creating scheduled tasks set to run every hour.^[7]

GravityRAT creates a scheduled task to ensure it is re-executed everyday.^[43]

GRIFFON has used sctasks for persistence. ^[44]

Helminth has used a scheduled task for persistence.^[45]

HotCroissant has attempted to install a scheduled task named "Java Maintenance64" on startup to establish persistence.^[46]

IcedID has created a scheduled task that executes every hour to establish persistence.^[47]

InvisiMole has used scheduled tasks named MSST and \Microsoft\Windows\Autochk\Scheduled to establish persistence.^[48]

ISMInjector creates scheduled tasks to establish persistence.^[49]

JHUHUGIT has registered itself as a scheduled task to run each time the current user logs in.^[50][51]

The different components of Machete are executed by Windows Task Scheduler.^[52]

Machete used scheduled tasks for persistence.^[53]

Matroyshka can establish persistence by adding a Scheduled Task named "Microsoft Boost Kernel Optimization".^[54][55]

Maze has created scheduled tasks using name variants such as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update", to launch Maze at a specific time.^[56]

MCMD can use scheduled tasks for persistence.^[57]

menuPass has used a script (atexec.py) to execute a command on a target machine via Task Scheduler.^[58]

MuddyWater has used scheduled tasks to establish persistence.^[59]

NotPetya creates a task to reboot the system one hour after infection.^[60]

OilRig has created scheduled tasks that run a VBScript to execute a payload on victim machines.^[61][62][63]

Okrum's installer can attempt to achieve persistence by creating a scheduled task.^[64]

OopsIE creates a scheduled task to run itself every three minutes.^[61][65]

A Patchwork file stealer can run a TaskScheduler DLL to add persistence.^[66]

PowerSploit's New-UserPersistenceOption Persistence argument can be used to establish via a Scheduled Task/Job.^[67][68]

POWERSTATS has established persistence through a scheduled task using the command "C:\Windows\system32\schtasks.exe" /Create /F /SC DAILY /ST 12:00 /TN MicrosoftEdge /TR "c:\Windows\system32\wscript.exe C:\Windows\temp\Windows.vbe".^[69]

POWRUNER persists through a scheduled task that executes it every minute.^[70]

Pteranodon schedules tasks to invoke its components in order to establish persistence.^[71]

QUADAGENT creates a scheduled task to maintain persistence on the victim’s machine.^[62]

QuasarRAT contains a .NET wrapper DLL for creating and managing scheduled tasks for maintaining persistence upon reboot.^[72]

Ramsay can schedule tasks via the Windows COM API to maintain persistence.^[73]

Rancor launched a scheduled task to gain persistence using the schtasks /create /sc command.^[74]

Remexi utilizes scheduled tasks as a persistence mechanism.^[75]

RemoteCMD can execute commands remotely by creating a new schedule task on the remote system^[76]

Revenge RAT schedules tasks to run malicious scripts at different intervals.^[77]

RTM tries to add a scheduled task to establish persistence.^[78][79]

schtasks is used to schedule tasks on a Windows system to run at a specific date and time.^[80]

ServHelper contains modules that will use schtasks to carry out malicious operations.^[81]

Shamoon copies an executable payload to the target system by using Windows Admin Shares and then scheduling an unnamed task to execute the malware.^[82][83]

Silence has used scheduled tasks to stage its operation.^[84]

Smoke Loader launches a scheduled task.^[85]

Soft Cell established persistence for PoisonIvy by created a scheduled task.^[86]

SoreFang can gain persistence through use of scheduled tasks.^[87]

SQLRat has created scheduled tasks in %appdata%\Roaming\Microsoft\Templates\.^[37]

Stealth Falcon malware creates a scheduled task entitled "IE Web Cache" to execute a malicious file hourly.^[88]

TEMP.Veles has used scheduled task XML triggers.^[89]

TrickBot creates a scheduled task on the system that provides persistence.^[90][91][92]

UNC2452 used scheduler and schtasks to create new tasks on remote hosts as part of lateral movement.^[93] They also manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.^[94] UNC2452 also created a scheduled task to maintain Sunspot persistence when the host booted.^[95]

Valak has used scheduled tasks to execute additional payloads and to gain persistence on a compromised host.^[96][97][98]

Wizard Spider has used scheduled tasks establish persistence for TrickBot and other malware.^{[99][100][101][102]}

yty establishes persistence by creating a scheduled task with the command SchTasks /Create /SC DAILY /TN BigData /TR " + path_file + "/ST 09:30".^[103]

zwShell has used SchTasks for execution.^[104]

Toolkits like the PowerSploit framework contain PowerUp modules that can be used to explore systems for permission weaknesses in scheduled tasks that could be used to escalate privileges. ^[105]

Configure settings for scheduled tasks to force tasks to run under the context of the authenticated account instead of allowing them to run as SYSTEM. The associated Registry key is located at HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SubmitControl. The setting can be configured through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > Security Options: Domain Controller: Allow server operators to schedule tasks, set to disabled. ^[106]

Configure the Increase Scheduling Priority option to only allow the Administrators group the rights to schedule a priority process. This can be configured through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Increase scheduling priority. ^[107]

Limit privileges of user accounts and remediate Privilege Escalation vectors so only authorized administrators can create scheduled tasks on remote systems.