{"id":"T1053","name":"Scheduled Task/Job","url":"https://attack.mitre.org/techniques/T1053","tactics":["execution","persistence","privilege-escalation"],"platforms":["Containers","ESXi","Linux","macOS","Network Devices","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0094","stix_id":"x-mitre-detection-strategy--df11466a-27a2-4cb1-bf73-2a3a4aaee0d9","name":"Cross-Platform Behavioral Detection of Scheduled Task/Job Abuse","url":"https://attack.mitre.org/detectionstrategies/DET0094","analytics":[{"id":"AN0258","stix_id":"x-mitre-analytic--a0714b4d-5dbf-499e-a737-7b00478267ee","name":"Analytic 0258","description":"Detects creation or modification of scheduled tasks using schtasks.exe, at.exe, or COM objects followed by execution of outlier processes tied to the scheduled job.","url":"https://attack.mitre.org/detectionstrategies/DET0094#AN0258","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4698","data_component":"DC0001","data_component_name":"Scheduled Job Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=2","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TaskAuthor","description":"Unexpected user or account context initiating the task."},{"field":"CommandLineRegex","description":"Suspicious binaries or script usage tied to scheduled tasks."},{"field":"ExecutionWindow","description":"Lookback window to correlate process execution after task registration."}],"live":true,"detection_strategies":["DET0094"],"techniques":["T1053"]},{"id":"AN0259","stix_id":"x-mitre-analytic--3374a404-06f9-4b32-bf94-5ac688fb9dad","name":"Analytic 0259","description":"Detects creation or modification of cron jobs via crontab, /etc/cron.* directories, or systemd timer units with execution by unusual users or non-standard intervals.","url":"https://attack.mitre.org/detectionstrategies/DET0094#AN0259","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"write, rename","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"linux:osquery","channel":"crontab, systemd_timers","data_component":"DC0001","data_component_name":"Scheduled Job Creation","log_source_slug":"linux-osquery"}],"mutable_elements":[{"field":"CronSchedulePattern","description":"Look for high-frequency or off-hour scheduling patterns."},{"field":"ServiceUser","description":"Unusual users scheduling jobs (e.g., www-data, nobody)."},{"field":"BinaryEntropy","description":"Abnormal scripts or binaries tied to the scheduled job."}],"live":true,"detection_strategies":["DET0094"],"techniques":["T1053"]},{"id":"AN0260","stix_id":"x-mitre-analytic--8cbda989-39e6-4f9e-8e23-213f92b3479d","name":"Analytic 0260","description":"Detects creation or alteration of LaunchAgents or LaunchDaemons with corresponding plist modification followed by execution of associated binaries.","url":"https://attack.mitre.org/detectionstrategies/DET0094#AN0260","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"process launch","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"fs:fsusage","channel":"disk activity on /Library/LaunchAgents or LaunchDaemons","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"fs-fsusage"},{"name":"macos:osquery","channel":"launchd_jobs","data_component":"DC0001","data_component_name":"Scheduled Job Creation","log_source_slug":"macos-osquery"}],"mutable_elements":[{"field":"PlistLabel","description":"Labels not associated with known applications or vendors."},{"field":"LaunchPath","description":"Executable path outside of standard directories (/usr/bin, /Applications)."},{"field":"JobRunInterval","description":"Unexpected periodic job intervals (e.g., every minute)."}],"live":true,"detection_strategies":["DET0094"],"techniques":["T1053"]},{"id":"AN0261","stix_id":"x-mitre-analytic--d20d7cf8-ecac-4011-96e0-3ec862223c11","name":"Analytic 0261","description":"Detects unusual use of `cron` or `sleep` loops inside containers executing unfamiliar scripts or binaries repeatedly.","url":"https://attack.mitre.org/detectionstrategies/DET0094#AN0261","platforms":["Containers"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"containerd:runtime","channel":"file change monitoring within /etc/cron.*, /tmp, or mounted volumes","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"containerd-runtime"}],"mutable_elements":[{"field":"ContainerLabel","description":"Labels or tags indicating dev/test containers executing scheduled tasks."},{"field":"ScriptFrequency","description":"Repetitive invocation pattern within short container lifespan."},{"field":"ImageSource","description":"Unexpected container image sources creating cron entries."}],"live":true,"detection_strategies":["DET0094"],"techniques":["T1053"]},{"id":"AN0262","stix_id":"x-mitre-analytic--e5adcc7e-5d68-4080-bb87-e901f297485d","name":"Analytic 0262","description":"Detects modification of ESXi cron jobs, local.sh scripts, or scheduled API calls to persist custom binaries or shell scripts.","url":"https://attack.mitre.org/detectionstrategies/DET0094#AN0262","platforms":["ESXi"],"log_source_references":[{"name":"esxi:vmkernel","channel":"Startup script and task execution logs","data_component":"DC0001","data_component_name":"Scheduled Job Creation","log_source_slug":"esxi-vmkernel"},{"name":"esxi:hostd","channel":"shell access or job registration","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"esxi-hostd"},{"name":"esxi:cron","channel":"manual edits to /etc/rc.local.d/local.sh or cron.d","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"esxi-cron"}],"mutable_elements":[{"field":"StartupScriptName","description":"Filename not matching expected initialization scripts."},{"field":"ExecutionContext","description":"Commands run from unexpected SSH sessions or elevated shells."},{"field":"PersistenceInterval","description":"Rare scheduling triggers (e.g., @reboot + hourly repetition)."}],"live":true,"detection_strategies":["DET0094"],"techniques":["T1053"]}],"live":true,"version":"1.0","techniques":["T1053"]}],"sigma_rules":[{"id":"058f4380-962d-40a5-afce-50207d36d7e2","title":"HackTool - CrackMapExec Execution Patterns","author":"Thomas Patzke","status":"stable","level":"high","date":"2020-05-22","modified":"2023-11-06","description":"Detects various execution patterns of the CrackMapExec pentesting framework","references":["https://github.com/byt3bl33d3r/CrackMapExec"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.t1047","attack.t1053","attack.t1059.003","attack.t1059.001","attack.s0106"],"path":"rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution_patterns.yml","techniques":["T1047","T1053","T1059.003","T1059.001"],"cves":[]},{"id":"0fcd1c79-4eeb-4746-aba9-1b458f7a79cb","title":"Remote Schedule Task Lateral Movement via ATSvc","author":"Sagie Dulce, Dekel Paz","status":"test","level":"high","date":"2022-01-01","modified":null,"description":"Detects remote RPC calls to create or execute a scheduled task via ATSvc","references":["https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931","https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md","https://github.com/zeronetworks/rpcfirewall","https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/"],"logsource":{"product":"rpc_firewall","category":"application"},"tags":["attack.privilege-escalation","attack.lateral-movement","attack.execution","attack.persistence","attack.t1053","attack.t1053.002"],"path":"rules/application/rpc_firewall/rpc_firewall_atsvc_lateral_movement.yml","techniques":["T1053","T1053.002"],"cves":[]},{"id":"26488ad0-f9fd-4536-876f-52fea846a2e4","title":"HackTool - SharPersist Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-09-15","modified":"2023-02-04","description":"Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms","references":["https://www.mandiant.com/resources/blog/sharpersist-windows-persistence-toolkit","https://github.com/mandiant/SharPersist"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053"],"path":"rules/windows/process_creation/proc_creation_win_hktl_sharpersist.yml","techniques":["T1053"],"cves":[]},{"id":"42a993dd-bb3e-48c8-b372-4d6684c4106c","title":"HackTool - CrackMapExec Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-02-25","modified":"2023-03-08","description":"This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.","references":["https://mpgn.gitbook.io/crackmapexec/smb-protocol/authentication/checking-credentials-local","https://www.mandiant.com/resources/telegram-malware-iranian-espionage","https://www.infosecmatter.com/crackmapexec-module-library/?cmem=mssql-mimikatz","https://www.infosecmatter.com/crackmapexec-module-library/?cmem=smb-pe_inject"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.persistence","attack.privilege-escalation","attack.credential-access","attack.discovery","attack.t1047","attack.t1053","attack.t1059.003","attack.t1059.001","attack.t1110","attack.t1201"],"path":"rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution.yml","techniques":["T1047","T1053","T1059.003","T1059.001","T1110","T1201"],"cves":[]},{"id":"4720b7df-40c3-48fd-bbdf-fd4b3c464f0d","title":"Scheduled TaskCache Change by Uncommon Program","author":"Syed Hasan (@syedhasan009)","status":"test","level":"high","date":"2021-06-18","modified":"2025-10-22","description":"Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious","references":["https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/","https://labs.f-secure.com/blog/scheduled-task-tampering/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053","attack.t1053.005"],"path":"rules/windows/registry/registry_set/registry_set_taskcache_entry.yml","techniques":["T1053","T1053.005"],"cves":[]},{"id":"671ffc77-50a7-464f-9e3d-9ea2b493b26b","title":"Cisco Modify Configuration","author":"Austin Clark","status":"test","level":"medium","date":"2019-08-12","modified":"2025-04-28","description":"Modifications to a config that will serve an adversary's impacts or persistence","references":[],"logsource":{"product":"cisco","service":"aaa"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.impact","attack.t1490","attack.t1505","attack.t1565.002","attack.t1053"],"path":"rules/network/cisco/aaa/cisco_cli_modify_config.yml","techniques":["T1490","T1505","T1565.002","T1053"],"cves":[]},{"id":"80e1f67a-4596-4351-98f5-a9c3efabac95","title":"Suspicious Scheduled Task Write to System32 Tasks","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-11-16","modified":"2022-01-12","description":"Detects the creation of tasks from processes executed from suspicious locations","references":["Internal Research"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.t1053"],"path":"rules/windows/file/file_event/file_event_win_susp_task_write.yml","techniques":["T1053"],"cves":[]},{"id":"ace3ff54-e7fd-46bd-8ea0-74b49a0aca1d","title":"Remote Schedule Task Lateral Movement via ITaskSchedulerService","author":"Sagie Dulce, Dekel Paz","status":"test","level":"high","date":"2022-01-01","modified":null,"description":"Detects remote RPC calls to create or execute a scheduled task","references":["https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931","https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md","https://github.com/zeronetworks/rpcfirewall","https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/"],"logsource":{"product":"rpc_firewall","category":"application"},"tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.lateral-movement","attack.t1053","attack.t1053.002"],"path":"rules/application/rpc_firewall/rpc_firewall_itaskschedulerservice_lateral_movement.yml","techniques":["T1053","T1053.002"],"cves":[]},{"id":"aff229ab-f8cd-447b-b215-084d11e79eb0","title":"Remote Schedule Task Lateral Movement via SASec","author":"Sagie Dulce, Dekel Paz","status":"test","level":"high","date":"2022-01-01","modified":null,"description":"Detects remote RPC calls to create or execute a scheduled task via SASec","references":["https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931","https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md","https://github.com/zeronetworks/rpcfirewall","https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/"],"logsource":{"product":"rpc_firewall","category":"application"},"tags":["attack.privilege-escalation","attack.lateral-movement","attack.execution","attack.persistence","attack.t1053","attack.t1053.002"],"path":"rules/application/rpc_firewall/rpc_firewall_sasec_lateral_movement.yml","techniques":["T1053","T1053.002"],"cves":[]},{"id":"bbb2dedd-a0e3-46ab-ba6c-6c82ae7a9aa7","title":"HAFNIUM Exchange Exploitation Activity","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2021-03-09","modified":"2023-03-09","description":"Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers","references":["https://blog.truesec.com/2021/03/07/exchange-zero-day-proxylogon-and-hafnium/","https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/","https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289/3","https://twitter.com/GadixCRK/status/1369313704869834753?s=20","https://twitter.com/BleepinComputer/status/1372218235949617161"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1546","attack.t1053","attack.g0125","detection.emerging-threats"],"path":"rules-emerging-threats/2021/TA/HAFNIUM/proc_creation_win_apt_hafnium.yml","techniques":["T1546","T1053"],"cves":[]},{"id":"c5a178bf-9cfb-4340-b584-e4df39b6a3e7","title":"Defrag Deactivation - Security","author":"Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1)","status":"test","level":"medium","date":"2019-03-04","modified":"2022-11-27","description":"Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group","references":["https://securelist.com/apt-slingshot/84312/"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053","attack.s0111","detection.emerging-threats"],"path":"rules-emerging-threats/2018/TA/Slingshot/win_security_apt_slingshot.yml","techniques":["T1053"],"cves":[]},{"id":"e1118a8f-82f5-44b3-bb6b-8a284e5df602","title":"Potential ACTINIUM Persistence Activity","author":"Andreas Hunkeler (@Karneades)","status":"test","level":"high","date":"2022-02-07","modified":"2023-03-18","description":"Detects specific process parameters as used by ACTINIUM scheduled task persistence creation.","references":["https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053","attack.t1053.005","detection.emerging-threats"],"path":"rules-emerging-threats/2022/TA/ACTINIUM/proc_creation_win_apt_actinium_persistence.yml","techniques":["T1053","T1053.005"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2024-4577","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-38831","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}