Techniques › T1053
T1053 Scheduled Task/Job
execution · persistence · privilege escalation — Containers, ESXi, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
12
Sigma rules tagged attack.t1053
2
KEV CVEs mapped here
<p>Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.</p><p>Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges). Similar to System Binary Proxy Execution, adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2024-4577 | PHP Group PHP | secondary impact | Mapped | 2024-06-12 |
| CVE-2023-38831 | RARLAB WinRAR | secondary impact | Mapped | 2023-08-24 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0094 Cross-Platform Behavioral Detection of Scheduled Task/Job Abuse v1.0
AN0258 WindowsDetects creation or modification of scheduled tasks using schtasks.exe, at.exe, or COM objects followed by execution of outlier processes tied to the scheduled job.Tunable:
TaskAuthorCommandLineRegexExecutionWindowAN0259 LinuxDetects creation or modification of cron jobs via crontab, /etc/cron.* directories, or systemd timer units with execution by unusual users or non-standard intervals.Tunable:CronSchedulePatternServiceUserBinaryEntropyAN0260 macOSDetects creation or alteration of LaunchAgents or LaunchDaemons with corresponding plist modification followed by execution of associated binaries.Tunable:PlistLabelLaunchPathJobRunIntervalAN0261 ContainersDetects unusual use ofcronorsleeploops inside containers executing unfamiliar scripts or binaries repeatedly.containerd:runtimefile change monitoring within /etc/cron.*, /tmp, or mounted volumes→ DC0061 File ModificationTunable:ContainerLabelScriptFrequencyImageSourceAN0262 ESXiDetects modification of ESXi cron jobs, local.sh scripts, or scheduled API calls to persist custom binaries or shell scripts.Tunable:StartupScriptNameExecutionContextPersistenceInterval
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1053
Author: Thomas Patzke
· 2020-05-22 (modified 2023-11-06) · logsource: product=windows category=process_creation · 058f4380-962d-40a5-afce-50207d36d7e2
Detects various execution patterns of the CrackMapExec pentesting framework
Author: Sagie Dulce, Dekel Paz
· 2022-01-01 · logsource: product=rpc_firewall category=application · 0fcd1c79-4eeb-4746-aba9-1b458f7a79cb
Detects remote RPC calls to create or execute a scheduled task via ATSvc
Author: Florian Roth (Nextron Systems)
· 2022-09-15 (modified 2023-02-04) · logsource: product=windows category=process_creation · 26488ad0-f9fd-4536-876f-52fea846a2e4
Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms
Author: Florian Roth (Nextron Systems)
· 2022-02-25 (modified 2023-03-08) · logsource: product=windows category=process_creation · 42a993dd-bb3e-48c8-b372-4d6684c4106c
This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.
Author: Syed Hasan (@syedhasan009)
· 2021-06-18 (modified 2025-10-22) · logsource: product=windows category=registry_set · 4720b7df-40c3-48fd-bbdf-fd4b3c464f0d
Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious
Author: Austin Clark
· 2019-08-12 (modified 2025-04-28) · logsource: product=cisco service=aaa · 671ffc77-50a7-464f-9e3d-9ea2b493b26b
Modifications to a config that will serve an adversary's impacts or persistence
Author: Florian Roth (Nextron Systems)
· 2021-11-16 (modified 2022-01-12) · logsource: product=windows category=file_event · 80e1f67a-4596-4351-98f5-a9c3efabac95
Detects the creation of tasks from processes executed from suspicious locations
Author: Sagie Dulce, Dekel Paz
· 2022-01-01 · logsource: product=rpc_firewall category=application · ace3ff54-e7fd-46bd-8ea0-74b49a0aca1d
Detects remote RPC calls to create or execute a scheduled task
Author: Sagie Dulce, Dekel Paz
· 2022-01-01 · logsource: product=rpc_firewall category=application · aff229ab-f8cd-447b-b215-084d11e79eb0
Detects remote RPC calls to create or execute a scheduled task via SASec
Author: Florian Roth (Nextron Systems)
· 2021-03-09 (modified 2023-03-09) · logsource: product=windows category=process_creation · bbb2dedd-a0e3-46ab-ba6c-6c82ae7a9aa7
Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers
Author: Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1)
· 2019-03-04 (modified 2022-11-27) · logsource: product=windows service=security · c5a178bf-9cfb-4340-b584-e4df39b6a3e7
Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group
Author: Andreas Hunkeler (@Karneades)
· 2022-02-07 (modified 2023-03-18) · logsource: product=windows category=process_creation · e1118a8f-82f5-44b3-bb6b-8a284e5df602
Detects specific process parameters as used by ACTINIUM scheduled task persistence creation.