Full Report
MITRE ATT&CK Walkthrough: T1053.005 (Scheduled Task/Job: Scheduled Task)
Analysis Summary
# Tool/Technique: T1053.005 - Scheduled Task
## Overview
Scheduled Task (T1053.005) is a sub-technique of the Scheduled Task/Job mechanism in Windows. It is a built-in operating system feature used by administrators for routine maintenance but is frequently abused by threat actors to achieve persistence, execute code with elevated privileges, or schedule future malicious actions. Because legitimate use is ubiquitous, it serves as an effective "Living off the Land" (LotL) tactic to evade detection.
## Technical Details
- **Type:** Technique (Built-in OS Functionality)
- **Platform:** Windows
- **Capabilities:** Persistence, Privilege Escalation, Execution
- **First Seen:** Continuous (Native Windows feature since Windows NT)
## MITRE ATT&CK Mapping
- **TA0003 - Persistence**
- T1053 - Scheduled Task/Job
- T1053.005 - Scheduled Task
- **TA0004 - Privilege Escalation**
- T1053.005 - Scheduled Task
- **TA0002 - Execution**
- T1053.005 - Scheduled Task
## Functionality
### Core Capabilities
- **Automated Execution:** Allows programs or scripts to run automatically at specific times or in response to specific triggers (e.g., system startup, user logon).
- **Persistence:** Ensures malicious code survives reboots, logoffs, or credential rotations.
- **Privilege Management:** Tasks can be configured to run under the `SYSTEM` account or other highly privileged service accounts.
### Advanced Features
- **Hidden Execution:** Tasks can be configured to run in the background without user interaction.
- **Masquerading:** Attackers name tasks to mimic legitimate Windows services (e.g., "Windows Update Check") to blend into process lists.
- **Remote Creation:** Tasks can be created on remote systems via RPC or PowerShell to facilitate lateral movement.
## Indicators of Compromise
- **File Names:** `schtasks.exe`, `taskeng.exe` (Primary binaries used for task management).
- **Registry Keys:** `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks`
- **Behavioral Indicators:**
- A process spawning `schtasks.exe` that originated from a document (Word/Excel), script host (`wscript.exe`), or unexpected PowerShell session.
- Tasks pointing to binaries in `\Temp\`, `\Users\<User>\AppData\`, or other non-standard/writable paths.
- Use of `/ru System` (Run-as SYSTEM) in the command line paired with `/sc onlogon` or `/sc onstart`.
## Associated Threat Actors
- **Widespread Use:** This technique is used by almost all major threat groups, including:
- APT groups (e.g., APT28, APT29)
- Ransomware operators (for persistence and cleanup)
- Commodity malware (e.g., Emotet, TrickBot)
## Detection Methods
- **Signature-based detection:** Monitoring for common malicious task names or suspicious command-line strings (e.g., `/create /tn "Update" /tr "C:\Users\...\tmp.exe"`).
- **Behavioral detection:**
- Monitoring for `schtasks.exe` execution where the parent process is a web browser, office application, or unknown script.
- Analyzing Windows Event Logs: **Event ID 4698** (Task Created) and **Event ID 4702** (Task Updated).
- **Contextual Analysis:** Using tools like Symantec CBX/Threat Tracer to verify the "creation chain"—identifying if a task was created by a known RMM tool/admin or an unauthorized process.
## Mitigation Strategies
- **Prevention measures:** Restrict the use of `schtasks.exe` and PowerShell task cmdlets to authorized administrators only.
- **Hardening recommendations:**
- Implement the Principle of Least Privilege; ensure tasks do not run as `SYSTEM` unless absolutely necessary.
- Audit and baseline existing scheduled tasks to identify anomalies.
- Use GPOs to disable or restrict the Task Scheduler service on sensitive workstations.
## Related Tools/Techniques
- **T1053.002:** At (Linux/Unix)
- **T1053.003:** Cron (Linux/Unix)
- **T1543.003:** Windows Service (Alternative persistence mechanism)
- **Tool:** `schtasks.exe` (Native Windows utility)
- **Tool:** `at.exe` (Legacy Windows utility)