ATT&CK coverage › Technique
Scheduled Task/Job: Scheduled Task T1053.005
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.
Events covered
15 catalog events are tagged with this technique by at least one rule.
Authoring guide
Patterns shared across the 48 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (29 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (416 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.
Common exclusions (13 distinct)
Field/operator/value combinations that rules under this technique routinely exclude (top-level not() clauses). These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 31 rules
- HackTool - Default PowerSploit/Empire Scheduled Task Creation
- Important Scheduled Task Deleted/Disabled
- Persistence and Execution at Scale via GPO Scheduled Task
- Potential Persistence Via Microsoft Compatibility Appraiser
- Potential Persistence Via Powershell Search Order Hijacking - Task
- Potential Registry Persistence Attempt Via Windows Telemetry
- Potential SSH Tunnel Persistence Install Using A Scheduled Task
- Powershell Create Scheduled Task
- Renamed Schtasks Execution
- Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE
- Scheduled Task Creation Masquerading as System Processes
- Scheduled Task Creation Via Schtasks.EXE
- Scheduled Task Creation with Curl and PowerShell Execution Combo
- Scheduled Task Executed From A Suspicious Location
- Scheduled Task Executed Uncommon LOLBIN
- Scheduled Task Executing Encoded Payload from Registry
- Scheduled Task Executing Payload from Registry
- Scheduled TaskCache Change by Uncommon Program
- Schtasks Creation Or Modification With SYSTEM Privileges
- Schtasks From Suspicious Folders
- Suspicious Command Patterns In Scheduled Task Creation
- Suspicious Modification Of Scheduled Tasks
- Suspicious Scheduled Task Creation
- Suspicious Scheduled Task Creation Involving Temp Folder
- Suspicious Scheduled Task Creation via Masqueraded XML File
- Suspicious Scheduled Task Name As GUID
- Suspicious Scheduled Task Update
- Suspicious Schtasks Execution AppData Folder
- Suspicious Schtasks Schedule Type With High Privileges
- Suspicious Schtasks Schedule Types
- Uncommon One Time Only Scheduled Task At 00:00
Elastic 5 rules
- A scheduled task was created
- Remote Scheduled Task Creation via RPC
- Scheduled Task Execution at Scale via GPO
- Temporarily Scheduled Task Creation
- Unusual Scheduled Task Update
Splunk 11 rules
- Randomly Generated Scheduled Task Name
- Short Lived Scheduled Task
- Windows Compatibility Telemetry Tampering Through Registry
- Windows Enable Win32 ScheduledJob via Registry
- Windows PowerShell ScheduleTask
- Windows Registry Delete Task SD
- Windows Scheduled Task with Suspicious Command
- Windows Scheduled Task with Suspicious Name
- WinEvent Scheduled Task Created to Spawn Shell
- WinEvent Scheduled Task Created Within Public Path
- WinEvent Windows Task Scheduler Event Action Started