T1053.005PersistenceExecutionPrivilege Escalation

Scheduled Task Persistence

A scheduled task is a quiet, reliable way to survive a reboot and re-launch a payload. Here is what task creation looks like in your logs and the rules that flag the malicious ones.

Run it live: Phishing to Lateral Movement

After landing on the workstation, drop a scheduled task for persistence and watch task-creation events (4698 / Sysmon) land in Wazuh.

Launch it

Attackers need to survive reboots and losing their initial process. A scheduled task is a favorite because it is built in, runs on a trigger (logon, a schedule, idle), and can run as SYSTEM. It is also used for execution and, when it runs as a higher-privileged account, escalation. The technique is legitimate and constant in normal use, which is why detection is about the characteristics of the task, not its existence.

What it looks like

Security EID 4698 (a scheduled task was created), with the task's XML including its action.
Sysmon EID 1: schtasks.exe /create, or at.exe, often spawned by a script host.
The task action points to powershell.exe -enc, a script in %APPDATA%/%TEMP%, or rundll32.
Tasks that run as SYSTEM, trigger at logon, and were created by a non-admin tool are suspicious.

Detect it: Sigma

sigma / suspicious-scheduled-task.yml

title: Suspicious Scheduled Task Creation
id: 0f1a2b3c-task-4d5e-6f70-tyrian000008
status: stable
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\schtasks.exe'
      - '\at.exe'
    CommandLine|contains: '/create'
  suspicious:
    CommandLine|contains:
      - 'powershell'
      - '-enc'
      - 'AppData'
      - '\Temp\'
      - 'rundll32'
      - 'mshta'
      - 'DownloadString'
  condition: selection and suspicious
level: high
tags:
  - attack.persistence
  - attack.execution
  - attack.t1053.005

Detect it: Wazuh

wazuh / local_rules.xml

<group name="sysmon,persistence,attack,">
  <rule id="100710" level="10">
    <if_group>sysmon_event1</if_group>
    <field name="win.eventdata.image">schtasks\.exe$|at\.exe$</field>
    <field name="win.eventdata.commandLine">/create</field>
    <field name="win.eventdata.commandLine">powershell|-enc|AppData|\\Temp\\|rundll32|mshta|DownloadString</field>
    <description>Suspicious scheduled task creation (T1053.005)</description>
    <mitre>
      <id>T1053.005</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <!-- Also catch it from the Security channel (4698) -->
  <rule id="100711" level="8">
    <if_group>windows_security</if_group>
    <field name="win.system.eventID">^4698$</field>
    <description>Scheduled task created (review for persistence, T1053.005)</description>
    <mitre>
      <id>T1053.005</id>
    </mitre>
  </rule>
</group>

Reduce the surface

Enable auditing for task creation (4698) and forward the task XML, the action is the evidence.
Baseline the tasks your software legitimately creates so the alert stays high-signal.
Restrict who can create tasks that run as SYSTEM.
Hunt for tasks whose action is an encoded PowerShell or a binary in a user-writable path.

In Tyrian's Phishing to Lateral Movement scenario you can establish persistence with a scheduled task after landing, and confirm your 4698 / Sysmon task-creation detection catches it.

Test this detection on your own SIEM

Launch the Phishing to Lateral Movement range, fire T1053.005, and measure how fast you catch it. $5 free credit, no card.

Start free More techniques