Scheduled Task/Job

What is Scheduled Task/Job?

“Scheduled Task/Job is documented as technique T1053 in MITRE ATT&CK® v19.1 under the Execution tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Scheduled Task/Job activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor schtasks.exe and at.exe process creation events, particularly those creating tasks that run at system startup, execute from unusual paths, or use obfuscated command line arguments including encoded PowerShell.

2. 2

   Audit the Windows Task Scheduler registry keys and XML task definitions for recently created or modified tasks, focusing on tasks using SYSTEM or Administrator accounts and tasks pointing to executable paths in user-writable locations.

3. 3

   Monitor cron file modifications on Linux systems using file integrity monitoring, alerting on changes to /etc/crontab, /etc/cron.d/, user crontabs, and /etc/rc.local which are commonly abused for persistence.

4. 4

   Correlate scheduled task creation events with user authentication events to identify tasks created immediately after suspicious logins or during known attack timeframes identified through incident response.

5. 5

   Alert on scheduled tasks executing PowerShell or cmd.exe with encoded arguments, or tasks that download content from the internet using certutil, bitsadmin, or curl as these patterns indicate malicious use.

Example Alerts

These realistic alert examples show what Scheduled Task/Job looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Scheduled Task/Job?

Detection centers on XDR, SIEM telemetry for the execution phase of the attack. Monitor schtasks.exe and at.exe process creation events, particularly those creating tasks that run at system startup, execute from unusual paths, or use obfuscated command line arguments including encoded PowerShell. Audit the Windows Task Scheduler registry keys and XML task definitions for recently created or modified tasks, focusing on tasks using SYSTEM or Administrator accounts and tasks pointing to executable paths in user-writable locations.

What does a Scheduled Task/Job alert look like?

A representative SIEM detection is "Suspicious Scheduled Task Created for Persistence" (high severity): New scheduled task created via schtasks.exe named "WindowsUpdateHelper" configured to run at system startup. The task executes PowerShell with an encoded command from a file in %AppData%\Local\Temp. This naming convention and execution pattern is consistent with persistence mechanisms used by multiple commodity malware families.

Which tools detect Scheduled Task/Job, and how can I practice?

Scheduled Task/Job (T1053) is best surfaced with XDR, SIEM telemetry, which exposes the execution signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.