Detect Scheduled Task in Elastic Security
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. Attackers use schtasks.exe, the Task Scheduler GUI, .NET wrappers, WMI (via Win32_ScheduledJob or PS_ScheduledTask), or direct registry manipulation to create, modify, or delete scheduled tasks. Tasks can run under any account context including SYSTEM, enabling privilege escalation. Adversaries also create hidden tasks by deleting the Security Descriptor (SD) registry value, making tasks invisible to standard enumeration tools.
MITRE ATT&CK
- Technique
- T1053 Scheduled Task/Job
- Sub-technique
- T1053.005 Scheduled Task
- Canonical reference
- https://attack.mitre.org/techniques/T1053/005/
Elastic Detection Query
sequence by host.name with maxspan=5m
[
any where event.category == "process" and
process.name : "schtasks.exe" and
(
process.args : ("/create", "/change") and
(
process.args : ("*\\AppData\\*", "*\\Temp\\*", "*\\ProgramData\\*", "*\\Public\\*", "%temp%", "%appdata%", "%public%") or
process.args : ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "msbuild.exe", "wmic.exe", "msiexec.exe") or
process.args : ("/ru system", "/ru SYSTEM", "/ru \"NT AUTHORITY\\SYSTEM\"") or
process.args : "/s " or
process.args : ("/sc onlogon", "/sc onstartup", "/sc onstart") or
process.args : ("/sc minute", "/sc hourly") or
process.parent.name : ("powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "msiexec.exe", "wmic.exe", "winword.exe", "excel.exe", "outlook.exe", "acrord32.exe", "msedge.exe", "chrome.exe", "firefox.exe")
)
)
]
OR
sequence by host.name with maxspan=1m
[
any where event.category == "registry" and
event.type in ("creation", "change") and
registry.path : "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\*" and
not process.name : ("svchost.exe", "taskeng.exe", "taskhostw.exe")
]Detects Windows Scheduled Task abuse (T1053.005) via schtasks.exe process creation with suspicious arguments or parent processes, and direct Task Scheduler registry manipulation. Covers schtasks /create and /change operations targeting suspicious locations or binaries, high-privilege task scheduling (/ru SYSTEM), remote task creation (/s), logon/startup triggers, high-frequency scheduling, suspicious parent processes (Office apps, browsers, script engines), and unauthorized registry writes to the TaskCache key.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate software installers (e.g., Adobe, Microsoft updaters) that use schtasks.exe to register maintenance tasks in ProgramData or AppData during installation.
- System administrators and IT automation tools (Ansible, SCCM, PDQ Deploy) creating scheduled tasks via scripts, which may run under SYSTEM context or use PowerShell as a parent process.
- Security and monitoring software (e.g., CrowdStrike, Carbon Black, Qualys) that creates recurring scheduled tasks using schtasks.exe with elevated privileges.
- Developer CI/CD pipelines running on Windows build agents that invoke schtasks.exe as part of automated build or deployment scripts.
Other platforms for T1053.005
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Persistence Scheduled Task Running as SYSTEM
Expected signal: Sysmon Event ID 1: Process Create with Image=schtasks.exe, CommandLine containing '/create', '/tn WindowsSystemCheck', '/ru SYSTEM', '/sc onstart'. Security Event ID 4688 (if command line auditing enabled). Security Event ID 4698 (Scheduled Task Created) in Security log with task XML showing SYSTEM principal. Registry key created under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\ (ONSTART trigger).
- Test 2Scheduled Task with PowerShell Download Cradle Action
Expected signal: Sysmon Event ID 1: schtasks.exe with full command line including the PowerShell cradle. Security Event ID 4698 with task XML showing PowerShell action with hidden window and download cradle. Task XML file written to C:\Windows\System32\Tasks\MicrosoftEdgeUpdateCheck. Registry entries created under TaskCache\Logon\.
- Test 3Scheduled Task Created via PowerShell (Invoke-CimMethod)
Expected signal: Sysmon Event ID 1: powershell.exe process with command line containing Register-ScheduledTask. Security Event ID 4698: Scheduled Task Created (WmiTaskTest). Sysmon Event ID 13: Registry value written to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\ by powershell.exe (not svchost.exe). Task XML file written to C:\Windows\System32\Tasks\WmiTaskTest.
- Test 4Hidden Scheduled Task via SD Registry Value Deletion
Expected signal: Sysmon Event ID 1: schtasks.exe creating the task. Sysmon Event ID 14 (Registry Key/Value Deleted): TargetObject = HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\HiddenPersistTask\SD, Image = reg.exe. Security Event ID 4698: task created. After SD deletion, task is absent from schtasks /query but still active in TaskCache.
- Test 5Remote Scheduled Task Creation for Lateral Movement
Expected signal: Sysmon Event ID 1: schtasks.exe with CommandLine containing '/s 127.0.0.1', '/ru SYSTEM', '/create'. Security Event ID 4698: Scheduled Task Created on target (local) system. Network connection attempt to localhost Task Scheduler RPC interface (port 135/dynamic RPC). Security Event ID 4648 (Logon with explicit credentials) if alternate credentials used.
References (11)
- https://attack.mitre.org/techniques/T1053/005/
- https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/
- https://blog.qualys.com/vulnerabilities-threat-research/2022/06/20/defending-against-scheduled-task-attacks-in-windows-environments/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_sd_value_removal.yml
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events
- https://technet.microsoft.com/library/dd315590.aspx
- https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
- https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain
- https://learn.microsoft.com/en-us/windows/win32/taskschd/task-scheduler-start-page
- https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen
Unlock Pro Content
Get the full detection package for T1053.005 including response playbook, investigation guide, and atomic red team tests.