Wiki › Techniques, Tactics & Procedures (TTPs) › Execution › Scheduled Task Execution

Scheduled Task Execution

2 min read

Jump to:

Overview

Scheduled Task Execution is a technique used by adversaries to run malicious code or commands at predetermined times or intervals. It plays a critical role in maintaining persistence, executing payloads, and automating actions throughout various stages of the attack lifecycle. Attackers leverage this method to ensure continued access and operational control without requiring manual intervention.

Attack Objective

Establish and maintain persistence or execute code automatically
Supports multiple stages including Execution, Persistence, Privilege Escalation, and Lateral Movement
Enables attackers to automate tasks, evade detection, and maintain footholds within compromised environments

How the Technique Works

Adversaries create or modify scheduled tasks on target systems to trigger execution of malicious payloads or commands at specific times or system events. These tasks can be configured to run with elevated privileges and can recur indefinitely or execute once. By leveraging native scheduling frameworks, attackers automate their operations while blending with legitimate system activity.

Common Methods & Variations

Use of built-in task schedulers such as Windows Task Scheduler or cron jobs on Unix-like systems
Deployment in on-premises endpoints, servers, cloud virtual machines, and container environments
Utilization of living-off-the-land binaries (LOLBins) to create or manipulate scheduled tasks versus deploying custom scheduling tools

Indicators of Compromise (IOCs)

Creation or modification of scheduled tasks with unusual names, triggers, or actions
Execution logs showing tasks running unexpected scripts or binaries
Endpoint artifacts such as new or altered task definitions and associated files
Cloud or identity logs indicating scheduled execution of commands or functions

Detection Strategies

Monitoring task scheduler event logs and system audit logs for anomalous task creation or execution
Behavioral detection focusing on unusual task triggers, execution times, or command patterns
Correlation of scheduled task activity with other suspicious behaviors such as privilege escalation or lateral movement

Mitigation & Prevention

Restrict permissions to create or modify scheduled tasks to trusted administrators
Implement application whitelisting and control execution policies for scheduled tasks
Regularly audit scheduled tasks and remove unnecessary or suspicious entries
Enforce least privilege principles and multi-factor authentication for accounts with scheduling rights

Response Considerations

Immediately disable or delete unauthorized scheduled tasks upon detection
Investigate task creation timestamps, associated user accounts, and linked payloads to scope compromise
Perform system and network scans to identify related malicious activity or persistence mechanisms
Harden scheduling configurations and review access controls to prevent recurrence

Related Techniques

Process Injection for stealthy execution of scheduled payloads
Service Execution as an alternative persistence and execution method
Credential Access techniques to acquire permissions necessary for task creation
Lateral Movement techniques that leverage scheduled tasks to propagate within networks

Mapping & References

MITRE ATT&CK: T1053 Scheduled Task/Job (Execution, Persistence, Privilege Escalation)
Public research on adversary use of scheduled tasks in real-world incidents
Security advisories highlighting detection and mitigation best practices for scheduled task abuse

Tags: Cybersecurity Defense Evasion Execution Incident Response lateral movement MITRE ATT&CK persistence privilege escalation Scheduled Task Execution Threat Detection