CmdID

CmdID / Techniques / T1053

T1053.005 Scheduled Task/Job: Scheduled Task

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. MITRE ATT&CK

1 program on CmdID 32 Sigma rules T1053.005 on attack.mitre.org

Part of

MITRE ATT&CK
T1053Scheduled Task/Job

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
schtasks.exeExecute

Sigma rules tagged with it

process creation, the highest levels first
criticalOilRig APT ActivityFlorian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community · Windows
criticalTurla Group Commands May 2020Florian Roth (Nextron Systems) · Windows
highChromeLoader Malware Execution@kostastsale · Windows
highHackTool - Default PowerSploit/Empire Scheduled Task CreationMarkus Neis, @Karneades · Windows
highKapeka Backdoor Persistence ActivitySwachchhanda Shrawan Poudel · Windows
highOperation Wocao ActivityFlorian Roth (Nextron Systems), frack113 · Windows
highPotential ACTINIUM Persistence ActivityAndreas Hunkeler (@Karneades) · Windows
highPotential BearLPE ExploitationOlaf Hartong · Windows
highPotential Persistence Via Powershell Search Order Hijacking - TaskpH-T (Nextron Systems), Florian Roth (Nextron Systems) · Windows
highPotential SSH Tunnel Persistence Install Using A Scheduled TaskRory Duncan · Windows
highRenamed Schtasks ExecutionSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highScheduled Task Creation Masquerading as System ProcessesSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highScheduled Task Executing Encoded Payload from RegistrypH-T (Nextron Systems), @Kostastsale, TheDFIRReport, X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows
highSchtasks Creation Or Modification With SYSTEM PrivilegesNasreddine Bencherchali (Nextron Systems) · Windows
highSchtasks From Suspicious FoldersFlorian Roth (Nextron Systems) · Windows
highSerpent Backdoor Payload Execution Via Scheduled Task@kostastsale · Windows
highSuspicious Command Patterns In Scheduled Task CreationFlorian Roth (Nextron Systems) · Windows
highSuspicious Modification Of Scheduled TasksNasreddine Bencherchali (Nextron Systems) · Windows
highSuspicious Scheduled Task Creation Involving Temp FolderFlorian Roth (Nextron Systems) · Windows
highSuspicious Schtasks Execution AppData FolderpH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows
highSuspicious Schtasks Schedule TypesNasreddine Bencherchali (Nextron Systems) · Windows
highUncommon One Time Only Scheduled Task At 00:00pH-T (Nextron Systems) · Windows
mediumDefrag DeactivationFlorian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1) · Windows
mediumPotential Persistence Via Microsoft Compatibility AppraiserSreeman · Windows
mediumSchedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXEFlorian Roth (Nextron Systems) · Windows
mediumScheduled Task Creation From Potential Suspicious Parent LocationFlorian Roth (Nextron Systems) · Windows
mediumScheduled Task Creation with Curl and PowerShell Execution ComboSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
mediumScheduled Task Executing Payload from RegistryX__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows
mediumSuspicious Scheduled Task Creation via Masqueraded XML FileSwachchhanda Shrawan Poudel, Elastic (idea) · Windows
mediumSuspicious Scheduled Task Name As GUIDNasreddine Bencherchali (Nextron Systems) · Windows
mediumSuspicious Schtasks Schedule Type With High PrivilegesNasreddine Bencherchali (Nextron Systems) · Windows
lowScheduled Task Creation Via Schtasks.EXEFlorian Roth (Nextron Systems) · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

To schedule a security script, Sec.vbs, to run every 20 minutes, type on the page for schtasks create

schtasks /create /sc minute /mo 20 /tn "Security Script" /tr \\central\data\scripts\sec.vbsIdentify

To schedule a security script, Sec.vbs, to run on the local computer every 100 minutes between 5:00 P.M. and 7:59 A.M. each day, type on the page for schtasks create

schtasks /create /tn "Security Script" /tr sec.vbs /sc minute /mo 100 /st 17:00 /et 08:00 /kIdentify

To schedule the MyApp program to run every five hours, beginning on the first day of March 2002, type on the page for schtasks create

schtasks /create /sc hourly /mo 5 /sd 03/01/2002 /tn MyApp /tr c:\apps\myapp.exeIdentify

To schedule the MyApp program to run every 3 hours, for 10 hours total, type on the page for schtasks create

schtasks /create /tn MyApp /tr MyApp.exe /sc hourly /mo 3 /st 00:00 /du 0010:00Identify

To schedule the MyApp program to run every twelve days at 1:00 P.M. (13:00) beginning on December 31, 2021, type on the page for schtasks create

schtasks /create /tn MyApp /tr c:\apps\myapp.exe /sc daily /mo 12 /sd 12/31/2002 /st 13:00Identify

To schedule a security script, Sec.vbs, to run every 70 days, type on the page for schtasks create

schtasks /create /tn "Security Script" /tr sec.vbs /sc daily /mo 70 /itIdentify

To schedule the MyApp program to run on a remote computer every six weeks, type on the page for schtasks create

schtasks /create /tn MyApp /tr c:\apps\myapp.exe /sc weekly /mo 6 /s Server16 /u Admin01Identify

To schedule a task to run every other Friday, type on the page for schtasks create

schtasks /create /tn MyApp /tr c:\apps\myapp.exe /sc weekly /mo 2 /d FRIIdentify

To schedule the MyApp program to run every three months, type on the page for schtasks create

schtasks /create /tn MyApp /tr c:\apps\myapp.exe /sc monthly /mo 3Identify

An example is here when CmdID’s reading of it names T1053.005: a Sigma rule it trips is tagged with it, or its abuse is documented as it.