Scheduled Task

What is Scheduled Task?

“Scheduled Task is documented as technique T1053.005 in MITRE ATT&CK® v19.1 under the Persistence tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Scheduled Task activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Examine newly created scheduled task XML definitions for tasks using Base64-encoded PowerShell commands, tasks executing from temporary directories, and tasks configured to run with SYSTEM or elevated account credentials without a business justification.

2. 2

   Monitor Windows Event ID 4698 for scheduled task creation and Event ID 4702 for modification, correlating with the creating process and user account to identify tasks created through unusual means such as via mshta.exe or office applications.

3. 3

   Detect scheduled tasks created to run at logon or system startup from non-standard paths such as user AppData directories, temporary folders, or ProgramData subdirectories not associated with known software products.

4. 4

   Alert on scheduled tasks that download content from the internet during execution, using command lines containing PowerShell Invoke-WebRequest, certutil download flags, or bitsadmin transfer jobs embedded within the task action.

5. 5

   Implement baseline comparison for scheduled tasks on server and workstation images, alerting on any tasks present in the environment that do not appear in the approved baseline configuration for that system type.

Example Alerts

These realistic alert examples show what Scheduled Task looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Scheduled Task?

Detection centers on XDR, SIEM telemetry for the persistence phase of the attack. Examine newly created scheduled task XML definitions for tasks using Base64-encoded PowerShell commands, tasks executing from temporary directories, and tasks configured to run with SYSTEM or elevated account credentials without a business justification. Monitor Windows Event ID 4698 for scheduled task creation and Event ID 4702 for modification, correlating with the creating process and user account to identify tasks created through unusual means such as via mshta.exe or office applications.

What does a Scheduled Task alert look like?

A representative SIEM detection is "Scheduled Task with Encoded PowerShell Created at Startup" (high severity): Windows Event 4698 recorded creation of scheduled task "MicrosoftEdgeUpdateTaskMachineUA" via schtasks.exe on workstation WS-MKTG-044. Despite the legitimate-sounding name, the task action executes powershell.exe with -EncodedCommand containing a Base64 string that decodes to a Cobalt Strike stager. The task is configured to run at system startup under the SYSTEM account.

Which tools detect Scheduled Task, and how can I practice?

Scheduled Task (T1053.005) is best surfaced with XDR, SIEM telemetry, which exposes the persistence signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.