Execution with schtasks
Hypothesis and description
The Windows built-in tool schtasks.exe provides the creation, modification, and running of scheduled tasks on a local or remote computer. It is provided as a more flexible alternative to at.exe, described in CAR-2013-05-004. Although used by adversaries, the tool is also legitimately used by administrators, scripts, and software configurations. The scheduled tasks tool can be used to gain Persistence and can be used in combination with a Lateral Movement technique to remotely gain execution. Additionally, the command has parameters to specify the user and password responsible for creating the task, as well as the user and password combination that the task will run as. The /s flag specifies the remote system on which the task should be scheduled, usually indicating Lateral Movement.
- Platforms
- Windows
- Domain
- Host
- Subtypes
- Process
- Submitted
- 2013-08-07
- Contributors
- MITRE
ATT&CK coverage
| Technique | Tactics | Coverage |
|---|---|---|
| T1053 Scheduled Task/JobT1053.005 | Persistence | Moderate |
1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
D3FEND techniques MITRE maps to this analytic
Data model references
Fields from the CAR data model (object/action/field) the analytic reads.
Pseudocode and implementations
Look for instances of schtasks.exe running as processes. The command_line field is necessary to disambiguate between types of schtasks commands. These include the flags /create, /run, /query, /delete, /change, and /end.
process = search Process:Create
schtasks = filter process where (exe == "schtasks.exe")
output schtasksDNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=schtasks.exe AND $Process=regex(.*(\/create|\/run|\/query|\/delete|\/change|\/end).*)i limit 100LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 image="*\schtasks.exe" command IN ["*/create*", "*/run*", "*/query*", "*/delete*", "*/change*", "*/end*"]Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-SJAScheduled Job Analysis1 shared
- D3-SDMSystem Daemon Monitoring1 shared
- D3-ABPIApplication-based Process Isolation1 shared
- D3-HRHost Reboot1 shared
- D3-HSHost Shutdown1 shared
- D3-KBPIKernel-based Process Isolation1 shared
- D3-PLAProcess Lineage Analysis1 shared
- D3-PSMDProcess Self-Modification Detection1 shared
- D3-PSProcess Suspension1 shared
- D3-PTProcess Termination1 shared
- D3-HBPIHardware-based Process Isolation1 shared
- D3-PSAProcess Spawn Analysis1 shared