Elevation via Scheduled Tasks

Overview

Elevation via Scheduled Tasks is a technique where adversaries leverage legitimate task scheduling mechanisms to gain higher privileges or maintain persistence within a target environment. This method is commonly used during the privilege escalation and persistence phases of an attack lifecycle, enabling attackers to execute code with elevated rights or at specific intervals without direct user interaction.

Attack Objective

• Achieve privilege escalation or maintain persistent elevated execution capabilities
• Supports Privilege Escalation and Persistence stages of the attack lifecycle
• Advances attacker position by enabling execution of malicious payloads with elevated permissions or on a recurring basis, facilitating stealthy control and lateral movement

How the Technique Works

Adversaries create, modify, or abuse scheduled tasks to execute arbitrary code under elevated privileges or at scheduled times. These tasks can be configured to run with SYSTEM or administrator-level rights, allowing attackers to bypass standard user restrictions. By manipulating task definitions, attackers can automate execution of payloads, maintain footholds, or escalate privileges without requiring direct interaction.

Common Methods & Variations

• Creation of new scheduled tasks with elevated privileges
• Modification of existing legitimate tasks to execute malicious binaries or scripts
• Use of built-in Windows Task Scheduler or analogous scheduling services on other platforms
• On-premises endpoint exploitation via Windows Scheduled Tasks; cloud environments may involve scheduled functions or cron jobs
• Living-off-the-land approaches leveraging native scheduling utilities versus deploying custom scheduling tools

Indicators of Compromise (IOCs)

• Unusual or unauthorized scheduled task creation or modification events in system logs
• Execution of unexpected binaries or scripts triggered by scheduled tasks
• Task definitions referencing suspicious file paths or command-line arguments
• Elevated privilege execution events correlated with scheduled task triggers
• Endpoint logs showing task scheduler activity outside normal operational patterns

Detection Strategies

• Monitoring Windows Event Logs (e.g., Task Scheduler operational logs, Security logs for process creation)
• Behavioral detection focusing on anomalous task creation or modification patterns
• Correlation of scheduled task execution with privilege escalation or lateral movement indicators
• Signature-based detection of known malicious payloads launched via scheduled tasks
• Use of endpoint detection and response (EDR) tools to identify suspicious task-related activities

Mitigation & Prevention

• Implement least privilege principles to limit who can create or modify scheduled tasks
• Restrict and monitor access to task scheduler interfaces and related APIs
• Enforce application whitelisting to prevent unauthorized binaries from executing via scheduled tasks
• Regularly audit scheduled tasks for unauthorized or suspicious entries
• Apply system and software updates to reduce vulnerabilities that enable privilege escalation

Response Considerations

• Immediately disable or delete unauthorized scheduled tasks identified during investigation
• Perform comprehensive system and network analysis to determine scope and impact of the compromise
• Review and harden task scheduling permissions and configurations post-incident
• Conduct credential audits and reset compromised accounts if privilege escalation is confirmed
• Implement enhanced monitoring to detect re-creation or modification of scheduled tasks

Related Techniques

• Credential Dumping – often used in conjunction to acquire elevated credentials
• Process Injection – may be employed alongside scheduled tasks to execute code stealthily
• Service Execution – alternative method for privilege escalation and persistence
• Scheduled Task/Job – sub-techniques involving different scheduling mechanisms
• Persistence via Registry Run Keys or Startup Folder – other persistence mechanisms

Mapping & References

• MITRE ATT&CK: T1053 – Scheduled Task/Job
• MITRE ATT&CK: T1068 – Exploitation for Privilege Escalation
• Public research articles and incident reports detailing abuse of scheduled tasks for privilege escalation and persistence
• Vendor and community advisories on monitoring and securing task scheduling services