Full Report
Actionable guide to hunting for the scheduled tasks by using Group-IB MXDR
Analysis Summary
# Tool/Technique: Scheduled Tasks (Persistence & Execution)
## Overview
Scheduled Tasks are a native Windows mechanism used to automate the execution of programs or scripts at specific times or intervals. In a cybersecurity context, attackers leverage this functionality to maintain persistence on a compromised host, execute commands with elevated privileges, or bypass detection by blending in with legitimate administrative activities.
## Technical Details
- **Type:** Technique
- **Platform:** Windows
- **Capabilities:** Persistence, Privilege Escalation, Remote Execution, Evasion.
- **First Seen:** Long-standing native Windows feature; heavily utilized by APTs and Ransomware groups for decades.
## MITRE ATT&CK Mapping
- **TA0003 - Persistence**
- T1053.005 - Scheduled Task/Job: Scheduled Task
- **TA0004 - Privilege Escalation**
- T1053.005 - Scheduled Task/Job: Scheduled Task
- **TA0002 - Execution**
- T1053.005 - Scheduled Task/Job: Scheduled Task
## Functionality
### Core Capabilities
- **Task Creation:** Attackers can create tasks via the command line (`schtasks.exe`), PowerShell (`New-ScheduledTask`), or the Windows API.
- **Trigger-based Execution:** Tasks can be set to trigger on user logon, system startup, or specific time intervals.
- **Binary/Script Execution:** Capability to run any executable, PowerShell script, or system utility (e.g., `cmd.exe`, `bitsadmin.exe`).
### Advanced Features
- **XML-Based Deployment:** Tasks can be defined in XML format and imported, allowing for complex configurations without passing strings through the command line (evading simple command-line monitoring).
- **System Privileges:** Tasks can be configured to run as the `SYSTEM` account, facilitating privilege escalation.
- **Native Parent Process Spawning:** When a task executes, it is spawned by legitimate system processes, making it harder to distinguish from standard OS behavior.
## Indicators of Compromise
- **File Names:** Files located in `C:\Windows\System32\Tasks\` (these are XML task definitions).
- **Registry Keys:** `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks`
- **Behavioral Indicators:**
- Process creation where the parent process is `taskeng.exe` or `taskhostw.exe`.
- Service activity related to `svchost.exe -k netsvcs -p -s Schedule`.
- Unusual command-line arguments passed to `schtasks.exe /create`.
## Associated Threat Actors
- **Almost all sophisticated actors, including:**
- APT28 (Fancy Bear)
- APT29 (Cozy Bear)
- Lazarus Group
- Various Ransomware-as-a-Service (RaaS) affiliates (e.g., LockBit, Conti).
## Detection Methods
- **Behavioral Detection (Process Parenting):**
- Monitor for processes where the parent is `taskeng.exe` or `taskhost.exe`.
- Query (MXDR/EDR): `event_type: "Process creation" AND (Payload.ParentImageFileName: ["*taskeng*", "*taskhost*" ] OR Payload.ParentCommandLine: "*\\svchost.exe -k netsvcs -p -s Schedule")`.
- **File System Monitoring:**
- Monitor for new files in `C:\Windows\System32\Tasks\`.
- Query: `event_type: "File creation" AND Payload.FileName: "*\\Windows\\System32\\Tasks\\*"`.
- **Command Line Monitoring:**
- Alert on `schtasks.exe` usage, specifically the `/create` and `/run` flags combined with suspicious directories like `\AppData\Local\Temp\`.
## Mitigation Strategies
- **Least Privilege:** Prevent standard users from creating scheduled tasks or accessing `schtasks.exe` where possible.
- **Hardening:** Use Group Policy (GPO) to restrict the creation of scheduled tasks to authorized administrators only.
- **Audit Logging:** Enable "Audit Other Object Access Events" and "Audit Task Scheduler" to generate Event IDs 4698 (Task Created) and 4702 (Task Updated).
## Related Tools/Techniques
- **BITS Jobs:** Another native Windows method for persistence and execution.
- **WMI Event Subscription:** A similar, more stealthy persistence mechanism.
- **Service Control Manager (SCM):** Persistence through the creation of malicious Windows Services.