Wiki › Techniques, Tactics & Procedures (TTPs) › Persistence › Scheduled Task Persistence

Scheduled Task Persistence

2 min read

Jump to:

Overview

Scheduled Task Persistence is a technique where adversaries create or modify scheduled tasks to maintain long-term access to a compromised system. This method leverages legitimate operating system features to execute malicious code at predefined times or system events, enabling attackers to persist through reboots and evade detection.

Attack Objective

Maintain persistent access and control over a target system
Supports the Persistence stage of the attack lifecycle, often following initial access and preceding privilege escalation or lateral movement
Allows adversaries to automate execution of payloads or commands, ensuring continued foothold without repeated exploitation

How the Technique Works

Adversaries create new scheduled tasks or alter existing ones to trigger execution of malicious payloads at specific times, system events, or user actions. These tasks run with the privileges of the account under which they are configured, enabling attackers to execute code with elevated rights if configured accordingly. The use of native task scheduling utilities helps blend malicious activity with legitimate system operations.

Common Methods & Variations

Creation of scheduled tasks using built-in tools such as Task Scheduler on Windows or cron jobs on Unix-like systems
Modification of existing scheduled tasks to replace or append malicious commands
Use of cloud-based scheduled functions or identity-based triggers in cloud environments
Employment of living-off-the-land binaries (LOLBins) like schtasks.exe or at.exe versus custom scripts or malware

Indicators of Compromise (IOCs)

Unusual or unauthorized scheduled tasks appearing in system task lists
Unexpected task triggers, execution times, or command-line arguments
Logs showing task creation, modification, or execution outside normal maintenance windows
Network connections or process launches initiated by scheduled tasks

Detection Strategies

Monitoring system logs and event logs related to task creation and execution (e.g., Windows Event ID 4698, 4700, 4702)
Behavioral analysis to identify anomalous task schedules or commands
Correlation of task execution with suspicious network or process activity
Use of endpoint detection and response (EDR) tools to track task-related process chains

Mitigation & Prevention

Restrict permissions to create or modify scheduled tasks to trusted administrators
Implement application whitelisting to control executable content run by scheduled tasks
Regularly audit scheduled tasks for unauthorized or suspicious entries
Enforce least privilege principles and multi-factor authentication for accounts with task scheduling rights

Response Considerations

Immediately disable or delete unauthorized scheduled tasks to prevent further execution
Investigate task creation timestamps, associated user accounts, and linked processes to scope the intrusion
Perform system and network forensics to identify potential lateral movement or data exfiltration
Harden task scheduling configurations and review access controls to prevent recurrence

Related Techniques

Service Registry Permissions Weakness for persistence via services
Startup Items for persistence through user or system startup scripts
Scheduled Task Execution as a method of execution
Credential Access and Privilege Escalation techniques that may follow persistence establishment

Mapping & References

MITRE ATT&CK T1543.003 – Create or Modify System Process: Scheduled Task
MITRE ATT&CK T1053 – Scheduled Task/Job
Public advisories and incident reports detailing use of scheduled tasks in advanced persistent threats

Tags: ATT&CK cyber threat Detection endpoint security Incident Response Mitigation persistence privilege escalation Scheduled Task TTP