T1053
Scheduled Task/Job
Containers · ESXi · Linux · macOS · Network Devices · Windows11 pieces on this siteT1053 on attack.mitre.org
Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments).
If this is happening now
Checklists and playbooks to open while the alert is still live.
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
How to find what an operator left behind
You have evicted somebody, or believe you have, and need to be sure there is no way back in.
Detect it
Hunts and rules you can run, each stating what it needs and what else it returns.
Sigma endpoint pack: seven rules for the Windows techniques that keep working
Shadow copy deletion, LSASS dumping through comsvcs, long encoded PowerShell, scheduled tasks and services in user-writable paths, WMI subscriptions and a cleared Security log. Each rule ships with the false positives it was written expecting.
Surface tasks created or altered outside a change window, and running from user-writable paths.
The evidence it leaves
Where the traces live, and what each source proves and does not.
systemd units and timers
Scheduled Tasks
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Guided lab: the scheduled task that looks like Windows
Plant a scheduled task with Atomic Red Team, then find it four ways and work out which one survives an attacker who names their task properly. Closes the loop on the persistence you found on the domain controller in the Northwind case.
Guided lab: nine hours at Northwind Freight, from lure to scheduled task
A constructed intrusion written as a DFIR report. You get the same artifacts an analyst gets on day one, in the order they arrive, and you build the timeline yourself. The company is fictional; the techniques, event IDs and analytic reasoning are not.
Somebody disabled the antivirus on eleven servers
You have minutes rather than hours. Say what you do first, and what you deliberately do not do.
Read
Analyses, case studies, guides, references and interview questions.
Windows event log cheat sheet: by the question you are asking
Organised by what you are trying to establish rather than by number: who logged on and how, what ran, what persisted, what was tampered with. Every entry says which log, whether it is on by default, and what it does not tell you.
linux-triage.sh: a read-only first-hour collection script for Linux
One Bash file that collects processes, sockets, deleted-but-running binaries, logons, SSH keys, persistence and recent changes in order of volatility, using only what ships with a distribution. It writes text files and a SHA-256 manifest, and it is short enough to read before you run it.
how MITRE says to see it
Cross-Platform Behavioral Detection of Scheduled Task/Job Abuse
- Detects creation or modification of scheduled tasks using schtasks.exe, at.exe, or COM objects followed by execution of outlier processes tied to the scheduled job.
- Detects creation or modification of cron jobs via crontab, /etc/cron.* directories, or systemd timer units with execution by unusual users or non-standard intervals.
- Detects creation or alteration of LaunchAgents or LaunchDaemons with corresponding plist modification followed by execution of associated binaries.
- Detects unusual use of `cron` or `sleep` loops inside containers executing unfamiliar scripts or binaries repeatedly.
what reduces it
- M1028 Operating System Configuration. Configure settings for scheduled tasks to force tasks to run under the context of the authenticated account instead of allowing them to run as SYSTEM. The associated Registry key is located at `HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SubmitControl`.
- M1018 User Account Management. Limit privileges of user accounts and remediate Privilege Escalation vectors so only authorized administrators can create scheduled tasks on remote systems.
- M1022 Restrict File and Directory Permissions. Restrict access by setting directory and file permissions that are not specific to users or privileged accounts.
- M1026 Privileged Account Management. Configure the Increase Scheduling Priority option to only allow the Administrators group the rights to schedule a priority process. This can be can be configured through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Increase scheduling priority.
- M1047 Audit. Toolkits like the PowerSploit framework contain PowerUp modules that can be used to explore systems for permission weaknesses in scheduled tasks that could be used to escalate privileges.