Scheduled Task/Job

What is Scheduled Task/Job?

Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication credentials are used to authenticate to the remote system. An adversary may use task scheduling to execute programs at system startup or on a scheduled basis for persistence, to conduct remote execution as part of lateral movement, or to run a process under the context of a specified account. On Windows, schtasks.exe and the Task Scheduler service provide scheduling capabilities. On Unix-based systems, cron, at, and launchd serve similar purposes. Scheduled tasks are attractive to attackers because they survive reboots, run with elevated privileges depending on configuration, and blend in with legitimate administrative task scheduling.

“Scheduled Task/Job is documented as technique T1053 in the MITRE ATT&CK knowledge base under the Execution tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Scheduled Task/Job activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor schtasks.exe and at.exe process creation events, particularly those creating tasks that run at system startup, execute from unusual paths, or use obfuscated command line arguments including encoded PowerShell.

2. 2

   Audit the Windows Task Scheduler registry keys and XML task definitions for recently created or modified tasks, focusing on tasks using SYSTEM or Administrator accounts and tasks pointing to executable paths in user-writable locations.

3. 3

   Monitor cron file modifications on Linux systems using file integrity monitoring, alerting on changes to /etc/crontab, /etc/cron.d/, user crontabs, and /etc/rc.local which are commonly abused for persistence.

4. 4

   Correlate scheduled task creation events with user authentication events to identify tasks created immediately after suspicious logins or during known attack timeframes identified through incident response.

5. 5

   Alert on scheduled tasks executing PowerShell or cmd.exe with encoded arguments, or tasks that download content from the internet using certutil, bitsadmin, or curl as these patterns indicate malicious use.

Example Alerts

These realistic alert examples show what Scheduled Task/Job looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Scheduled Task/Job?

SOC analysts detect Scheduled Task/Job (T1053) by monitoring XDR, SIEM telemetry for behavioral anomalies and specific indicators. Key detection methods include monitor schtasks.exe and at.exe process creation events, particularly those creating tasks that run at system startup, execute from unusual paths, or . SOCSimulator provides hands-on practice detecting this technique with realistic alerts.

What security tools are used to detect Scheduled Task/Job?

Scheduled Task/Job can be detected using XDR, SIEM platforms. XDR tools are particularly effective for this technique because they provide visibility into the execution phase of the attack chain. SOCSimulator simulates all three tool types for hands-on training.

How common is Scheduled Task/Job in real-world attacks?

Scheduled Task/Job is a well-documented MITRE ATT&CK technique in the Execution tactic. It appears in threat intelligence reports from multiple security vendors and has been observed in campaigns by various threat actor groups. SOCSimulator includes realistic Scheduled Task/Job scenarios based on documented attack patterns, helping analysts build detection intuition.

Can I practice detecting Scheduled Task/Job for free?

Yes. SOCSimulator offers free forever access to training scenarios, including Execution techniques like Scheduled Task/Job. You can investigate realistic alerts in guided Operations rooms, build detection skills with SIEM, XDR, and Firewall interfaces, and test yourself under pressure in Shift Mode. No credit card required.