T1053.005ExecutionPersistencePrivilege Escalation
Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries…
CVEs2
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.2
Reports0
Detections
52 Sigma rules tagged T1053.005Scheduled TaskT1053.00552 general rules
- Diamond Sleet APT Scheduled Task Creationcriticaltest
- OilRig APT Activitycriticaltest
- OilRig APT Registry Persistencecriticaltest
- OilRig APT Schedule Task Persistence - Securitycriticaltest
- OilRig APT Schedule Task Persistence - Systemcriticaltest
- Turla Group Commands May 2020criticaltest
- ChromeLoader Malware Executionhightest
- HackTool - Default PowerSploit/Empire Scheduled Task Creationhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Scheduled Task
2 CVEs, by priority. Each link shows its badge.- CVE-2021-34473Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1053.005Scheduled Task+3 more · 9 reportsMITRE CTID mapping of the KEV entry · primary impact>99.9%Top 0.01%89.4priority
- CVE-2023-46604Apache ActiveMQ Deserialization of Untrusted Data VulnerabilityApache · ActiveMQKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059.004Unix Shell+1 moreMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.01%79.9priority