Uncommon local scheduled task creation via schtasks.exe

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
Detector Tags	Scheduled tasks Analytics
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Scheduled Task/Job (T1053)
Severity	Informational

Description

The schtasks.exe command enables creating, deleting, querying, changing, running, and ending scheduled tasks on a local or remote computer. Adversaries may attempt to use the command to gain persistence on this host using scheduled tasks.

Attacker's Goals

Attackers may attempt to use the command to gain persistence on the endpoint using scheduled tasks.

Investigative actions

• Review the process that creates the schedule task.
• Investigate the specific scheduled task execution chain.

Variations

Uncommon local scheduled task creation via schtasks.exe by a remote actor

Synopsis

Field	Value
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Scheduled Task/Job (T1053)
Severity	Informational

Description

The schtasks.exe command enables creating, deleting, querying, changing, running, and ending scheduled tasks on a local or remote computer. Adversaries may attempt to use the command to gain persistence on this host using scheduled tasks.

Attacker's Goals

Attackers may attempt to use the command to gain persistence on the endpoint using scheduled tasks.

Investigative actions

• Review the process that creates the schedule task.
• Investigate the specific scheduled task execution chain.

Uncommon scheduled task created by an unsigned and rare actor via schtasks.exe

Synopsis

Field	Value
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Scheduled Task/Job (T1053)
Severity	Low

Description

The schtasks.exe command enables creating, deleting, querying, changing, running, and ending scheduled tasks on a local or remote computer. Adversaries may attempt to use the command to gain persistence on this host using scheduled tasks.

Attacker's Goals

Attackers may attempt to use the command to gain persistence on the endpoint using scheduled tasks.

Investigative actions

• Review the process that creates the schedule task.
• Investigate the specific scheduled task execution chain.

Uncommon scheduled task created by an unsigned actor via schtasks.exe

Synopsis

Field	Value
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Scheduled Task/Job (T1053)
Severity	Low

Description

The schtasks.exe command enables creating, deleting, querying, changing, running, and ending scheduled tasks on a local or remote computer. Adversaries may attempt to use the command to gain persistence on this host using scheduled tasks.

Attacker's Goals

Attackers may attempt to use the command to gain persistence on the endpoint using scheduled tasks.

Investigative actions

• Review the process that creates the schedule task.
• Investigate the specific scheduled task execution chain.

Uncommon scheduled task created by a signed actor from a rare vendor via schtasks.exe

Synopsis

Field	Value
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Scheduled Task/Job (T1053)
Severity	Low

Description

The schtasks.exe command enables creating, deleting, querying, changing, running, and ending scheduled tasks on a local or remote computer. Adversaries may attempt to use the command to gain persistence on this host using scheduled tasks.

Attacker's Goals

Attackers may attempt to use the command to gain persistence on the endpoint using scheduled tasks.

Investigative actions

• Review the process that creates the schedule task.
• Investigate the specific scheduled task execution chain.