Applied Cybernetics Group
T1053 Scheduled Task/Job
- Technique
T1053- Tactics
- Execution, Persistence, Privilege Escalation
- Research, 90 days
- 1
- KEV CVEs mapped
- 2
- SigmaHQ rules
- 12
- Elastic, Splunk
- 45
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1053
MITRE description
Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.(Citation: TechNet Task Scheduler Security) Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges). Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.(Citation: ProofPoint Serpent)
KEV CVEs mapped to this technique
MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-08-13Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them
Detection coverage
SigmaHQ community rules
- Defrag Deactivation - Security (emerging-threats)
- HAFNIUM Exchange Exploitation Activity (emerging-threats)
- Potential ACTINIUM Persistence Activity (emerging-threats)
- Remote Schedule Task Lateral Movement via ATSvc (core)
- Remote Schedule Task Lateral Movement via ITaskSchedulerService (core)
- Remote Schedule Task Lateral Movement via SASec (core)
- Cisco Modify Configuration (core)
- Suspicious Scheduled Task Write to System32 Tasks (core)
- HackTool - CrackMapExec Execution Patterns (core)
- HackTool - CrackMapExec Execution (core)
- HackTool - SharPersist Execution (core)
- Scheduled TaskCache Change by Uncommon Program (core)
Elastic and Splunk rules
- Azure Automation Runbook Created or Modified (elastic)
- Modification of Persistence Relevant Files Detected via Defend for Containers (elastic)
- Suspicious Echo or Printf Execution Detected via Defend for Containers (elastic)
- Potential Persistence via File Modification (elastic)
- OpenAI ChatGPT Enterprise Custom Agent Trigger Changed (elastic)
- Suspicious Network Activity to the Internet by Previously Unknown Executable (elastic)
- Suspicious Execution from Foomatic-rip or Cupsd Parent (elastic)
- Pod or Container Creation with Suspicious Command-Line (elastic)
- At Job Created or Modified (elastic)
- Cron Job Created or Modified (elastic)
- Kubernetes Sensitive Configuration File Activity (elastic)
- Kubernetes Static Pod Manifest File Access (elastic)
- Executable Bit Set for Potential Persistence Script (elastic)
- Systemd Timer Created (elastic)
- Suspicious CronTab Creation or Modification (elastic)
- Potential Persistence via Periodic Tasks (elastic)
- Privilege Escalation via Root Crontab File Modification (elastic)
- Potential Redis CONFIG SET Cron Directory Persistence (RedisRaider) (elastic)
- Suspicious ScreenConnect Client Child Process (elastic)
- Scheduled Tasks AT Command Enabled (elastic)
- Potential PowerShell HackTool Script by Function Names (elastic)
- Outbound Scheduled Task Activity via PowerShell (elastic)
- Remote Scheduled Task Creation via RPC (elastic)
- Remote Scheduled Task Creation (elastic)
- Persistence via Scheduled Job Creation (elastic)
Showing 25 of 45.