MITRE ATT&CKtechnique

T1053 Scheduled Task/Job

Published 2017-05-31 Modified 2026-05-12 Official page ↗

Domain: enterprise
Tactics: Execution, Persistence, Privilege Escalation
Platforms: Containers, ESXi, Linux, macOS, Network Devices, Windows
Version: 2.5
Created: 2017-05-31

Description

Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system. Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges). Similar to System Binary Proxy Execution, adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.

Tactic · MITRE ATT&CK (3)

TA0002 Execution tactic
TA0003 Persistence tactic
TA0004 Privilege Escalation tactic

Referenced by MITRE ATT&CK · mitigates (5)

M1047 Audit mitigation
M1018 User Account Management mitigation
M1022 Restrict File and Directory Permissions mitigation
M1026 Privileged Account Management mitigation
M1028 Operating System Configuration mitigation

Referenced by MITRE ATT&CK · subtechnique of (5)

T1053.007 Container Orchestration Job sub-technique
T1053.006 Systemd Timers sub-technique
T1053.003 Cron sub-technique
T1053.002 At sub-technique
T1053.005 Scheduled Task sub-technique

Referenced by MITRE ATT&CK · uses (2)

C0063 2025 Poland Wiper Attacks campaign
S0447 Lokibot software (malware)

Referenced by Compliance · mitigates (15)

CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
NIST-AC-2 Account Management NIST 800-53 control
NIST-AC-3 Access Enforcement NIST 800-53 control
NIST-AC-5 Separation of Duties NIST 800-53 control
NIST-AC-6 Least Privilege NIST 800-53 control
NIST-CM-2 Baseline Configuration NIST 800-53 control
NIST-CM-5 Access Restrictions for Change NIST 800-53 control
NIST-CM-6 Configuration Settings NIST 800-53 control
NIST-CM-7 Least Functionality NIST 800-53 control
NIST-CM-8 System Component Inventory NIST 800-53 control
NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
NIST-IA-4 Identifier Management NIST 800-53 control
NIST-IA-8 Identification and Authentication (Non-organizational Users) NIST 800-53 control
NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
NIST-SI-4 System Monitoring NIST 800-53 control

References

https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain ProofPoint Serpent
https://technet.microsoft.com/en-us/library/cc785125.aspx TechNet Task Scheduler Security