Scheduled Task/Job: Scheduled Task

Agent Tesla has achieved persistence via scheduled tasks.^[1]

Anchor can create a scheduled task for persistence.^[2]

AppleJeus has created a scheduled SYSTEM task that runs when a user logs in.^[3]

APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google.^[4]

APT29 used scheduler and schtasks to create new tasks on remote hosts as part of lateral movement.^[5] They have manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.^[6] APT29 also created a scheduled task to maintain SUNSPOT persistence when the host booted during the 2020 SolarWinds intrusion.^[7] They previously used named and hijacked scheduled tasks to also establish persistence.^[8]

An APT3 downloader creates persistence by creating the following scheduled task: schtasks /create /tn "mysc" /tr C:\Users\Public\test.exe /sc ONLOGON /ru "System".^[9]

APT32 has used scheduled tasks to persist on victim systems.^{[10][11][12][13]}

APT33 has created a scheduled task to execute a .vbe file multiple times a day.^[14]

APT37 has created scheduled tasks to run malicious scripts on a compromised host.^[15]

APT38 has used Task Scheduler to run programs at system startup or on a scheduled basis for persistence.^[16]

APT39 has created scheduled tasks for persistence.^[17][18][19]

APT41 used a compromised account to create a scheduled task on a system.^[20][21]

Attor's installer plugin can schedule a new task that loads the dispatcher on boot/logon.^[22]

BabyShark has used scheduled tasks to maintain persistence.^[21]

BackConfig has the ability to use scheduled tasks to repeatedly execute malicious payloads on a compromised host.^[23]

Bad Rabbit’s infpub.dat file creates a scheduled task to launch a malicious executable.^[24]

BADNEWS creates a scheduled task to establish by executing a malicious payload every subsequent minute.^[25]

Bazar can create a scheduled task for persistence.^[26][27]

Blue Mockingbird has used Windows Scheduled Tasks to establish persistence on local and remote hosts.^[28]

BONDUPDATER persists using a scheduled task that executes every minute.^[29]

BRONZE BUTLER has used schtasks to register a scheduled task to execute malware during lateral movement.^[30]

Carbon creates several tasks for later execution to continue persistence on the victim’s machine.^[31]

Chimera has used scheduled tasks to invoke Cobalt Strike including through batch script schtasks /create /ru "SYSTEM" /tn "update" /tr "cmd /c c:\windows\temp\update.bat" /sc once /f /st and to maintain persistence.^[32][33]

Cobalt Group has created Windows tasks to establish persistence.^[34]

ComRAT has used a scheduled task to launch its PowerShell loader.^[35][36]

CosmicDuke uses scheduled tasks typically named "Watchmon Service" for persistence.^[37]

CostaRicto has used scheduled tasks to download backdoor tools.^[38]

One persistence mechanism used by CozyCar is to register itself as a scheduled task.^[39]

Crutch has the ability to persist using scheduled tasks.^[40]

CSPY Downloader can use the schtasks utility to bypass UAC.^[41]

Dragonfly 2.0 used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files.^[42][43]

Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.^[44]

Dyre has the ability to achieve persistence by adding a new task in the task scheduler to run every minute.^[45]

Emotet has maintained persistence through a scheduled task. ^[46]

Empire has modules to interact with the Windows task scheduler.^[47]

EvilBunny has executed commands via scheduled tasks.^[48]

FIN10 has established persistence by using S4U tasks as well as the Scheduled Task option in PowerShell Empire.^[49][47]

FIN6 has used scheduled tasks to establish persistence for various malware it uses, including downloaders known as HARDTACK and SHIPBREAD and FrameworkPOS.^[50]

FIN7 malware has created scheduled tasks to establish persistence.^{[51][52][53][54]}

FIN8 has used scheduled tasks to maintain RDP backdoors.^[55]

Fox Kitten has used Scheduled Tasks for persistence and to load and execute a reverse proxy binary.^[56][57]

Frankenstein has established persistence through a scheduled task using the command: /Create /F /SC DAILY /ST 09:00 /TN WinUpdate /TR , named "WinUpdate".^[58]

GALLIUM established persistence for PoisonIvy by created a scheduled task.^[59]

Gamaredon Group has created a scheduled task to launch an executable every 10 minutes.^[60]

Gazer can establish persistence by creating a scheduled task.^[61][62]

GoldMax has used scheduled tasks to maintain persistence.^[63]

Goopy has the ability to maintain persistence by creating scheduled tasks set to run every hour.^[12]

GravityRAT creates a scheduled task to ensure it is re-executed everyday.^[64]

GRIFFON has used sctasks for persistence. ^[65]

GrimAgent has the ability to set persistence using the Task Scheduler.^[66]

Helminth has used a scheduled task for persistence.^[67]

Higaisa dropped and added officeupdate.exe to scheduled tasks.^[68][69]

HotCroissant has attempted to install a scheduled task named "Java Maintenance64" on startup to establish persistence.^[70]

IcedID has created a scheduled task that executes every hour to establish persistence.^[71]

InvisiMole has used scheduled tasks named MSST and \Microsoft\Windows\Autochk\Scheduled to establish persistence.^[72]

IronNetInjector has used a task XML file named mssch.xml to run an IronPython script when a user logs in or when specific system events are created.^[73]

ISMInjector creates scheduled tasks to establish persistence.^[74]

JHUHUGIT has registered itself as a scheduled task to run each time the current user logs in.^[75][76]

JSS Loader has the ability to launch scheduled tasks to establish persistence.^[77]

Lokibot embedded the commands schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I inside a batch script.^[78]

Lucifer has established persistence by creating the following scheduled task schtasks /create /sc minute /mo 1 /tn QQMusic ^ /tr C:Users\%USERPROFILE%\Downloads\spread.exe /F.^[79]

The different components of Machete are executed by Windows Task Scheduler.^[80][81]

Machete has created scheduled tasks to maintain Machete's persistence.^[82]

Matryoshka can establish persistence by adding a Scheduled Task named "Microsoft Boost Kernel Optimization".^[83][84]

Maze has created scheduled tasks using name variants such as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update", to launch Maze at a specific time.^[85]

MCMD can use scheduled tasks for persistence.^[86]

menuPass has used a script (atexec.py) to execute a command on a target machine via Task Scheduler.^[87]

Molerats has created scheduled tasks to persistently run VBScripts.^[88]

MuddyWater has used scheduled tasks to establish persistence.^[89]

Mustang Panda has created a scheduled task to execute additional malicious software, as well as maintain persistence.^[90][91][92]

Naikon has used schtasks.exe for lateral movement in compromised networks.^[93]

NETWIRE can create a scheduled task to establish persistence.^[94]

NotPetya creates a task to reboot the system one hour after infection.^[95]

OilRig has created scheduled tasks that run a VBScript to execute a payload on victim machines.^{[96][97][98][99]}

Okrum's installer can attempt to achieve persistence by creating a scheduled task.^[100]

OopsIE creates a scheduled task to run itself every three minutes.^[96][101]

Operation Wocao has used scheduled tasks to execute malicious PowerShell code on remote systems.^[102]

A Patchwork file stealer can run a TaskScheduler DLL to add persistence.^[103]

PowerSploit's New-UserPersistenceOption Persistence argument can be used to establish via a Scheduled Task/Job.^[104][105]

POWERSTATS has established persistence through a scheduled task using the command "C:\Windows\system32\schtasks.exe" /Create /F /SC DAILY /ST 12:00 /TN MicrosoftEdge /TR "c:\Windows\system32\wscript.exe C:\Windows\temp\Windows.vbe".^[106]

POWRUNER persists through a scheduled task that executes it every minute.^[107]

Pteranodon schedules tasks to invoke its components in order to establish persistence.^[108]

QakBot has the ability to create scheduled tasks for persistence.^{[109][110][111][112][113][114][115][116]}

QUADAGENT creates a scheduled task to maintain persistence on the victim’s machine.^[97]

QuasarRAT contains a .NET wrapper DLL for creating and managing scheduled tasks for maintaining persistence upon reboot.^[117]

RainyDay can use scheduled tasks to achieve persistence.^[93]

Ramsay can schedule tasks via the Windows COM API to maintain persistence.^[118]

Rancor launched a scheduled task to gain persistence using the schtasks /create /sc command.^[119]

Remexi utilizes scheduled tasks as a persistence mechanism.^[120]

RemoteCMD can execute commands remotely by creating a new schedule task on the remote system^[121]

Revenge RAT schedules tasks to run malicious scripts at different intervals.^[122]

RTM tries to add a scheduled task to establish persistence.^[123][124]

Ryuk can remotely create a scheduled task to execute itself on a system.^[125]

schtasks is used to schedule tasks on a Windows system to run at a specific date and time.^[126]

ServHelper contains modules that will use schtasks to carry out malicious operations.^[127]

Shamoon copies an executable payload to the target system by using SMB/Windows Admin Shares and then scheduling an unnamed task to execute the malware.^[128][129]

SharpStage has a persistence component to write a scheduled task for the payload.^[130]

Sibot has been executed via a scheduled task.^[63]

Silence has used scheduled tasks to stage its operation.^[131]

Smoke Loader launches a scheduled task.^[132]

SoreFang can gain persistence through use of scheduled tasks.^[133]

SQLRat has created scheduled tasks in %appdata%\Roaming\Microsoft\Templates\.^[54]

Stealth Falcon malware creates a scheduled task entitled "IE Web Cache" to execute a malicious file hourly.^[134]

Stuxnet schedules a network job to execute two minutes after host infection.^[135]

TEMP.Veles has used scheduled task XML triggers.^[136]

TrickBot creates a scheduled task on the system that provides persistence.^{[137][138][139]}

Valak has used scheduled tasks to execute additional payloads and to gain persistence on a compromised host.^{[140][141][142]}

Wizard Spider has used scheduled tasks establish persistence for TrickBot and other malware.^{[143][144][145][146]}

yty establishes persistence by creating a scheduled task with the command SchTasks /Create /SC DAILY /TN BigData /TR " + path_file + "/ST 09:30".^[147]

Zebrocy has a command to create a scheduled task for persistence.^[148]

zwShell has used SchTasks for execution.^[149]

Toolkits like the PowerSploit framework contain PowerUp modules that can be used to explore systems for permission weaknesses in scheduled tasks that could be used to escalate privileges. ^[150]

Configure settings for scheduled tasks to force tasks to run under the context of the authenticated account instead of allowing them to run as SYSTEM. The associated Registry key is located at HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SubmitControl. The setting can be configured through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > Security Options: Domain Controller: Allow server operators to schedule tasks, set to disabled. ^[151]

Configure the Increase Scheduling Priority option to only allow the Administrators group the rights to schedule a priority process. This can be configured through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Increase scheduling priority. ^[152]

Limit privileges of user accounts and remediate Privilege Escalation vectors so only authorized administrators can create scheduled tasks on remote systems.