← Threat archive

T1053.005 Scheduled Task/Job: Scheduled Task

4 threats tracked by Spectrum Delta use this technique.

T1053.005 on MITRE ATT&CK →

  • n0n credential extortion

    Locker and audit runs as SYSTEM scheduled tasks

    Windows Security task events (4698) and Sysmon process creation for schtasks.exe

    Seen in: Windows Security event log, Sysmon

  • Yoba signed-AI sideload

    WMP-masqueraded scheduled-task persistence

    Sysmon EID 11 file creation + EID 7 wmpdui.dll image load + Security 4698 task creation with the masqueraded fields

    Seen in: Windows file creation, Windows image load, Windows scheduled task

  • Armorsteal

    SEO-poisoned install chain: fake Chocolatey/MAS lure to scheduled-task persistence in a Windows masquerade path

    PowerShell script-block logs (download + elevation); Windows Task Scheduler operational log — creation of tasks named SysCheck2/SysCheckX; file-create events under C:\Windows\SystemHealth\Update\ (Update.zip/Updatef.zip, onetime_version.txt, global_version.txt); Zscaler MDR WIN-CONHOST-HEADLESS-CMD and WIN-SCHTASKS-CREATE-SHELL analytics fire on this chain

    Seen in: Windows event logs

  • MythicRatatoskr Yggdrasil C2

    Scheduled task pdfopentask executes PowerShell payload

    Task Scheduler operational log (task execution; creation events if enabled), Sysmon EID 1 for the PowerShell process and any schtasks.exe use; 4698 in Security log if task-creation auditing is on

    Seen in: Windows System/Security event logs, Sysmon / EDR