Cross-source coverage

T1053 / ATT&CK

Scheduled Task/Job

250 rules · 244 families across 12 sources.

Showing deprecated rules · back to the default

From MITRE ATT&CK 19.2

Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.

Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges). Similar to System Binary Proxy Execution, adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.

Platforms
Containers · ESXi · Linux · macOS · Network Devices · Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLlinux:osquerymacos:unifiedlogfs:fsusagemacos:osquerycontainerd:runtimeesxi:vmkernelesxi:hostdesxi:cron

How MITRE says to detect it DET0094

Cross-Platform Behavioral Detection of Scheduled Task/Job Abuse

Windows Analytic 0258

Detects creation or modification of scheduled tasks using schtasks.exe, at.exe, or COM objects followed by execution of outlier processes tied to the scheduled job.

  • WinEventLog:Security EventCode=4698
  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=2

Linux Analytic 0259

Detects creation or modification of cron jobs via crontab, /etc/cron.* directories, or systemd timer units with execution by unusual users or non-standard intervals.

  • auditd:SYSCALL write, rename
  • auditd:SYSCALL execve
  • linux:osquery crontab, systemd_timers

macOS Analytic 0260

Detects creation or alteration of LaunchAgents or LaunchDaemons with corresponding plist modification followed by execution of associated binaries.

  • macos:unifiedlog process launch
  • fs:fsusage disk activity on /Library/LaunchAgents or LaunchDaemons
  • macos:osquery launchd_jobs

Containers Analytic 0261

Detects unusual use of `cron` or `sleep` loops inside containers executing unfamiliar scripts or binaries repeatedly.

  • auditd:SYSCALL execve
  • containerd:runtime file change monitoring within /etc/cron.*, /tmp, or mounted volumes

ESXi Analytic 0262

Detects modification of ESXi cron jobs, local.sh scripts, or scheduled API calls to persist custom binaries or shell scripts.

  • esxi:vmkernel Startup script and task execution logs
  • esxi:hostd shell access or job registration
  • esxi:cron manual edits to /etc/rc.local.d/local.sh or cron.d

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 250 above — a rule tagged a sub-technique covers this technique too.

SigmaHQ/sigma

72 rules
Detection Severity Format
Diamond Sleet APT Scheduled Task Creation Critical Sigma
HAFNIUM Exchange Exploitation Activity Critical Sigma
OilRig APT Activity Critical Sigma
OilRig APT Registry Persistence Critical Sigma
OilRig APT Schedule Task Persistence - Security Critical Sigma
OilRig APT Schedule Task Persistence - System Critical Sigma
Turla Group Commands May 2020 Critical Sigma
ChromeLoader Malware Execution High Sigma
HackTool - CrackMapExec Execution High Sigma
HackTool - CrackMapExec Execution Patterns High Sigma

+ 62 more from SigmaHQ/sigma → showing the 10 highest-severity

splunk/security_content

51 rules
Detection Severity Format
Cisco Isovalent - Cron Job Creation Undefined SPL
Cisco Secure Firewall - Wget or Curl Download Undefined SPL
Kubernetes Cron Job Creation Undefined SPL
Linux Add Files In Known Crontab Directories Undefined SPL
Linux Adding Crontab Using List Parameter Undefined SPL
Linux At Allow Config File Creation Undefined SPL
Linux At Application Execution Undefined SPL
Linux Auditd At Application Execution Undefined SPL
Linux Auditd Edit Cron Table Parameter Undefined SPL
Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File Undefined SPL

+ 41 more from splunk/security_content → showing the 10 highest-severity

elastic/detection-rules

38 rules
Detection Severity Format
Persistence via TelemetryController Scheduled Task Hijack High Elastic TOML
Potential Redis CONFIG SET Cron Directory Persistence (RedisRaider) High Elastic TOML
Privilege Escalation via Root Crontab File Modification High Elastic TOML
Suspicious Echo or Printf Execution Detected via Defend for Containers High Elastic TOML
Suspicious Execution from Foomatic-rip or Cupsd Parent High Elastic TOML
At Job Created or Modified Medium Elastic TOML
Cron Job Created or Modified Medium Elastic TOML
Deprecated - Suspicious File Creation in /etc for Persistence Medium Elastic TOML
Executable Bit Set for Potential Persistence Script Medium Elastic TOML
Kubernetes Sensitive Configuration File Activity Medium Elastic TOML

+ 28 more from elastic/detection-rules → showing the 10 highest-severity

socfortress/Wazuh-Rules

28 rules · 25 families
Detection Severity Format
Creation or modification of persistent systemd timer or service file (T1053.006) High Wazuh XML
File created or modified in /etc/cron.d using shell or echo/tee High Wazuh XML
Possible persistence: writing cron job to /var/spool/cron/crontabs High Wazuh XML
Script created in /etc/cron.(daily|hourly|weekly|monthly) for persistence High Wazuh XML
Suspicious payload executed from systemd timer (T1053.006) High Wazuh XML
Sysmon - Event 1: Process creation · Modify Scheduled Task with PowerShell (T1053.005) High Wazuh XML
Sysmon - Event 1: Process creation · Scheduled Task Exec from Registry (T1053.005) High Wazuh XML
Sysmon - Event 1: Process creation · Scheduled Task via Office Macro (VBA) (T1053.005) High Wazuh XML
Sysmon - Event 1: Process creation · Scheduled Task via XML Import (T1053.005) High Wazuh XML
Modification of crontab detected (Potential persistence mechanism) Medium Wazuh XML

+ 18 more from socfortress/Wazuh-Rules → showing the 10 highest-severity

elastic/protections-artifacts

23 rules
Detection Severity Format
At Job Creation or Modification via Shell Command Undefined Elastic TOML
Cron Tab Creation or Modification via Shell Command Undefined Elastic TOML
Dual Persistence via Startup and Scheduled Task Undefined Elastic TOML
Hidden Payload Executed via Scheduled Job Undefined Elastic TOML
Potential Persistence via Direct Crontab Modification Undefined Elastic TOML
Potential Privilege Escalation via Root Crontab File Modification Undefined Elastic TOML
Potential UAC Bypass via IElevatedFactoryServer Undefined Elastic TOML
Scheduled Job Executing Binary in Unusual Location Undefined Elastic TOML
Scheduled Task by a Low Reputation Process Undefined Elastic TOML
Scheduled Task Creation by an Unusual Process Undefined Elastic TOML

+ 13 more from elastic/protections-artifacts → showing the 10 highest-severity

chronicle/detection-rules

19 rules
Detection Severity Format
mitre_attack_T1053_005_windows_creation_of_scheduled_task Informational YARA-L
abusing_windows_telemetry_compattelrunnerexeaudit_rule Undefined YARA-L
agenttesla_rat_detection Undefined YARA-L
a_scheduled_task_was_created Undefined YARA-L
covid19_phishing_campaign_fake_world_health_organization Undefined YARA-L
default_powersploit_and_empire_schtasks_persistence Undefined YARA-L
default_powersploit_schtasks_persistence Undefined YARA-L
diskshadow_and_vshadow_launch_detection Undefined YARA-L
flowerpippi_malware_detector_sysmon_behavior Undefined YARA-L
gelup_malware_detector_sysmon_behavior Undefined YARA-L

+ 9 more from chronicle/detection-rules → showing the 10 highest-severity

Wazuh Core Ruleset

7 rules
Detection Severity Format
Mshta loaded taskschd.dll module. May be used to create delayed malware execution High Wazuh XML
Root's crontab entry changed. Medium Wazuh XML
A scheduled task was created Low Wazuh XML
Process loaded taskschd.dll module. May be used to create delayed malware execution Low Wazuh XML
Task Scheduler: . · win.system.providerName = Microsoft-Windows-TaskScheduler, win.system.eventID = 106 Low Wazuh XML
Task Scheduler: . · win.system.providerName = Microsoft-Windows-TaskScheduler, win.system.eventID = 141 Low Wazuh XML
Task Scheduler: . · win.system.providerName = Microsoft-Windows-TaskScheduler, win.system.eventID = 142 Low Wazuh XML

panther-labs/panther-analysis

5 rules
Detection Severity Format
Suspicious cron detected High Panther Python
GCP GKE Kubernetes Cron Job Created Or Modified Medium Panther Python
Teleport Scheduled Jobs Medium Panther Python
Azure Automation Schedule Created or Modified Informational Panther Python
Kubernetes CronJob Created or Modified Informational Panther Python

Azure/Azure-Sentinel

3 rules
Detection Severity Format
Remote Task Creation/Update using Schtasks Process Low KQL
detect-impacket-atexec Undefined KQL
rare_sch_task_with_activity Undefined KQL

Bert-JanP/Hunting-Queries-Detection-Rules

2 rules
Detection Severity Format
MITRE ATT&CK Mapping Undefined KQL
Scheduled Tasks from AppData Created or Updated Undefined KQL

chainguard-dev/osquery-defense-kit

1 rule
Detection Severity Format
Unexpected crontab entries Undefined osquery SQL

falcosecurity/rules

1 rule
Detection Severity Format
Schedule Cron Jobs Low Falco YAML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.