Scheduled Task/Job T1053

Tactics: Execution, Persistence, Privilege Escalation

Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.

Events covered

35 catalog events are tagged with this technique by at least one rule.

ProviderEventTitle
SysmonEvent ID 1Process creation
SysmonEvent ID 3Network connection
SysmonEvent ID 7Image loaded
SysmonEvent ID 11FileCreate
SysmonEvent ID 12RegistryEvent (Object create and delete)
SysmonEvent ID 13RegistryEvent (Value Set)
SysmonEvent ID 14RegistryEvent (Key and Value Rename)
Security-AuditingEvent ID 4656A handle to an object was requested.
Security-AuditingEvent ID 4688A new process has been created.
Security-AuditingEvent ID 4698A scheduled task was created.
Security-AuditingEvent ID 4699A scheduled task was deleted.
Security-AuditingEvent ID 4700A scheduled task was enabled.
Security-AuditingEvent ID 4701A scheduled task was disabled.
Security-AuditingEvent ID 4702A scheduled task was updated.
Security-AuditingEvent ID 4799A security-enabled local group membership was enumerated.
Security-AuditingEvent ID 5136A directory service object was modified.
Security-AuditingEvent ID 5145A network share object was checked to see whether client can be granted desired access.
Defender-DeviceInfoanyDevice information
Defender-DeviceProcessEventsanyProcess activity
Defender-DeviceProcessEventsProcessCreatedProcess created
ESFexecProcess Execution
ESFwriteFile Write
Linux-AuditdEvent ID 1300SYSCALL
Linux-AuditdEvent ID 1302PATH
Linux-AuditdEvent ID 1307CWD
Linux-AuditdEvent ID 1327PROCTITLE
PowerShellEvent ID 4103Payload Context: ContextInfo User Data: UserData.
PowerShellEvent ID 4104Creating Scriptblock text (MessageNumber of MessageTotal).
TaskSchedulerEvent ID 129Task Scheduler launch task "Name" , instance "TaskName" with process ID Path.
TaskSchedulerEvent ID 200Task Scheduler launched action "TaskName" in instance "ActionName" of task "Name".
TaskSchedulerEvent ID 201Task Scheduler successfully completed task "Name" , instance "TaskInstanceId" , action "TaskName" .
RPCFWEvent ID 3An RPC server function was called.
Service-Control-ManagerEvent ID 7045A service was installed in the system.
Sysmon-for-LinuxEvent ID 1Process Create
Sysmon-for-LinuxEvent ID 11File created

Authoring guide

These 225 rules share fields, values, and exclusions.

Fields filtered most (128 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
CommandLine79contains 59, regex_match 10, in 8, wildcard 7, match 3, ends_with 1, eq 1, is_not_null 1, length_compare 1 /create , /create, /create , /change , (?i)\-(L|R|N|D|C)|IdentitiesOnly=yes|StrictHostKeyChecking=no|ssh
Image52ends_with 38, contains 5, eq 5, wildcard 5, starts_with 4, is_not_null 2, in 1\schtasks.exe, ?:\users\*\downloads\*, \cmd.exe, *\\perflogs\\*, *\\temp\\*
process_name50eq 33, in 18, starts_with 3, is_not_null 2schtasks.exe, bash, csh, dash, powershell.exe
EventType45eq 29, in 9, ne 4, starts_with 3exec, start, creation, modification, rename
EventID32eq 27, in 54698, 4104, 4688, 1, 4700
host.os.type31eq 31
TargetFilename29starts_with 13, wildcard 10, contains 3, eq 3, in 3, ends_with 1?:\windows\system32\tasks\, ?:\windows\tasks\, /etc/cron.allow, /etc/cron.d/*, /etc/systemd/system/*
event.type29eq 23, ne 6start, deletion, change
OriginalFileName27eq 25, in 1, ne 1schtasks.exe, cmd.exe, powershell.exe, adobe installer, at.exe
process.args26eq 15, starts_with 7, in 6, wildcard 5, contains 4-c, -create, /create, --command, -cl
parent_process_name20eq 17, in 7, starts_with 1, wildcard 1svchost.exe, cron, crond, systemd, cmd.exe
Channel12eq 12, in 12
eventtype12eq 12
ParentCommandLine11contains 7, eq 2, regex_match 2, ends_with 1, starts_with 1(?i)Temp\x5c[A-Za-z]{8}\.tmp, *, -executionpolicy bypass -windowstyle hidden -e jab, -k, -k netsvcs
ParentImage11ends_with 5, contains 2, eq 2, wildcard 2/dev/shm/*, \powershell.exe, ., ./*, /boot/*

Top indicator values (2172 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
Imageends_with
\schtasks.exe
2655
OriginalFileNameeq
schtasks.exe
2231
event.typeeq
start
201078
EventIDeq
4698
1313
process_nameeq
schtasks.exe
1330
process_nameeq
powershell.exe
6184
EventTypeeq
start
10391
EventTypeeq
exec
9576
EventTypeeq
creation
658
CommandLinecontains
/create
915
CommandLinecontains
/create
99
CommandLinecontains
/create
55
process_namein
bash
8202
process_namein
csh
8159
process_namein
dash
8170
process_namein
fish
8163
process_namein
ksh
8163
process_namein
sh
8197
process_namein
tcsh
8156
process_namein
zsh
8196
TargetFilenamestarts_with
?:\windows\system32\tasks\
66
TargetFilenamestarts_with
?:\windows\tasks\
57
event.typene
deletion
632
process.argseq
-create
66
process.argseq
/create
67
CommandLinewildcard
*disown*
510
CommandLinewildcard
*xxd *
512
event.categoryeq
process
5142
parent_process_nameeq
svchost.exe
519
process.code_signature.existseq
false
5119

Exclusions (1050 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
process.Ext.token.integrity_level_nameeq
system
5
process_nameeq
powershell.exe
5
file.extensionin
dpkg-remove
4
file.extensionin
swp
4
file.extensionin
swx
4
process.code_signature.trustedeq
true
4
userends_with
$
4
Imageends_with
\schtasks.exe
3
Imageeq
/usr/bin/crontab
3
Imagein
./usr/bin/podman
3
Imagein
/bin/autossl_check
3
Imagein
/bin/chef-client
3
Imagein
/bin/dnf
3
Imagein
/bin/dnf-automatic
3
Imagein
/bin/dockerd
3

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 79 rules

Elastic 60 rules

Splunk 65 rules

Kusto 15 rules

YARA-L 1 rule

Panther 5 rules