T1053ExecutionPersistencePrivilege Escalation
Scheduled Task/Job
Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments).…
CVEs2
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.2
Reports0
Detections
12 Sigma rules tagged T1053Scheduled Task/JobT105312 general rules
- HAFNIUM Exchange Exploitation Activitycriticaltest
- HackTool - CrackMapExec Execution Patternshighstable
- HackTool - CrackMapExec Executionhightest
- HackTool - SharPersist Executionhightest
- Potential ACTINIUM Persistence Activityhightest
- Remote Schedule Task Lateral Movement via ATSvchightest
- Remote Schedule Task Lateral Movement via ITaskSchedulerServicehightest
- Remote Schedule Task Lateral Movement via SASechightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Scheduled Task/Job
2 CVEs, by priority. Each link shows its badge.- CVE-2023-38831RARLAB WinRAR Code Execution VulnerabilityRARLAB · WinRARKEVRansomwarePublic exploitHigh · 7.8T1204User ExecutionT1053Scheduled Task/Job+5 more · 1 reportMITRE CTID mapping of the KEV entry · follow-on activity99.8%Top 0.04%82.3priority
- CVE-2024-4577PHP-CGI OS Command Injection VulnerabilityPHP Group · PHPKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+10 moreMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.02%79.9priority
Linked through a sub-technique
2 more- CVE-2021-34473Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1053.005Scheduled Task+3 more · 9 reports>99.9%Top 0.01%89.4priority
- CVE-2023-46604Apache ActiveMQ Deserialization of Untrusted Data VulnerabilityApache · ActiveMQKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059.004Unix Shell+1 more>99.9%Top 0.01%79.9priority