Technique:  Scheduled Task
DEADEYE has used the scheduled tasks \Microsoft\Windows\PLA\Server Manager Performance Monitor, \Microsoft\Windows\Ras\ManagerMobility, \Microsoft\Windows\WDI\SrvSetupResults, and \Microsoft\Windows\WDI\USOShared to establish persistence.
It used the command schtasks /Create /SC ONLOgon /TN WindowsUpdateCheck /TR "[file path]" /ru system for persistence.
Lokibot's second stage DLL has set a timer using "timeSetEvent" to schedule its next execution.
Remsec schedules the execution one of its modules by creating a new scheduler task.
StrifeWater has create a scheduled task named Mozilla\Firefox Default Browser Agent 409046Z0FF4A39CB for persistence.
It actors used the native at Windows task scheduler tool to use scheduled tasks for execution on a victim network.
at can be used to schedule a task on a system to be executed at a specific date or time.
It has used at to register a scheduled task to execute malware during lateral movement.
CrackMapExec can set a scheduled task on the target system to execute commands remotely using at.
MURKYTOP has the capability to schedule remote AT jobs.
It actors use at to schedule tasks to run self-extracting RAR archives, which install HTTPBrowser or PlugX on other victims on a network.
Anchor can install itself as a cron job.
It has used cron to create pre-scheduled and periodic background jobs on a Linux system.
Exaramel for Linux uses crontab for persistence if it does not have root privileges.
The GoldMax Linux variant has used a crontab entry with a @reboot line to gain persistence.
Janicab used a cron job for persistence on Mac devices.
Kinsing has used crontab to download and run shell scripts every minute to ensure persistence.
NETWIRE can use crontabs to establish persistence.
Penquin can use Cron to create periodic and pre-scheduled background jobs.
It installed a cron job that downloaded and executed files from the C2.
Skidmap has installed itself via crontab.
SpeakUp uses cron tasks to ensure persistence.
Xbash can create a cronjob for persistence if it determines it is on a Linux system.
Agent Tesla  has achieved persistence via scheduled tasks.
Anchor can create a scheduled task for persistence.
AppleJeus has created a scheduled SYSTEM task that runs when a user logs in.
It has used a macro function to set scheduled tasks, disguised as those used by Google.
It has used named and hijacked scheduled tasks to establish persistence.
An It downloader creates persistence by creating the following scheduled task: schtasks /create /tn "mysc" /tr C:\Users\Public\test.exe /sc ONLOGON /ru "System".
It has used scheduled tasks to persist on victim systems.
It has created a scheduled task to execute a .vbe file multiple times a day.
It has created scheduled tasks to run malicious scripts on a compromised host.
It has used Task Scheduler to run programs at system startup or on a scheduled basis for persistence.
It has created scheduled tasks for persistence.
It used a compromised account to create a scheduled task on a system.
AsyncRAT can create a scheduled task to maintain persistence on system start-up.
Attor's installer plugin can schedule a new task that loads the dispatcher on boot/logon.
BabyShark has used scheduled tasks to maintain persistence.
BackConfig has the ability to use scheduled tasks to repeatedly execute malicious payloads on a compromised host.
Bad Rabbit’s infpub.dat file creates a scheduled task to launch a malicious executable.
BADHATCH can use schtasks.exe to gain persistence.
BADNEWS creates a scheduled task to establish by executing a malicious payload every subsequent minute.
Bazar can create a scheduled task for persistence.
It has used scheduled tasks for persistence and execution.
It has used Windows Scheduled Tasks to establish persistence on local and remote hosts.
BONDUPDATER persists using a scheduled task that executes every minute.
It has used schtasks to register a scheduled task to execute malware during lateral movement.
Bumblebee can achieve persistence by copying its DLL to a subdirectory of %APPDATA% and creating a Visual Basic Script that will load the DLL via a scheduled task.
During C0017, It used the following Windows scheduled tasks for DEADEYE dropper persistence on US state government networks: \Microsoft\Windows\PLA\Server Manager Performance Monitor, \Microsoft\Windows\Ras\ManagerMobility, \Microsoft\Windows\WDI\SrvSetupResults, and \Microsoft\Windows\WDI\USOShared.
Carbon creates several tasks for later execution to continue persistence on the victim’s machine.
ccf32 can run on a daily basis using a scheduled task.
It has used scheduled tasks to invoke Cobalt Strike including through batch script schtasks /create /ru "SYSTEM" /tn "update" /tr "cmd /c c:\windows\temp\update.bat" /sc once /f /st and to maintain persistence.
It has created Windows tasks to establish persistence.
ComRAT has used a scheduled task to launch its PowerShell loader.
It has created scheduled tasks to maintain persistence on a compromised host.
CosmicDuke uses scheduled tasks typically named "Watchmon Service" for persistence.
During CostaRicto, the threat actors used scheduled tasks to download backdoor tools.
One persistence mechanism used by CozyCar is to register itself as a scheduled task.
Crutch has the ability to persist using scheduled tasks.
CSPY Downloader can use the schtasks utility to bypass UAC.
DanBot can use a scheduled task for installation.
DarkWatchman has created a scheduled task for persistence.
Disco can create a scheduled task to run every minute for persistence.
It has used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files.
Dridex can maintain persistence via the creation of scheduled tasks within system directories such as windows\system32\, windows\syswow64, winnt\system32, and winnt\syswow64.
Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.
Dyre has the ability to achieve persistence by adding a new task in the task scheduler to run every minute.
Emotet has maintained persistence through a scheduled task.
Empire has modules to interact with the Windows task scheduler.
EvilBunny has executed commands via scheduled tasks.
It has established persistence by using S4U tasks as well as the Scheduled Task option in PowerShell Empire.
It has created scheduled tasks in the C:\Windows directory of the compromised network.
It has used scheduled tasks to establish persistence for various malware it uses, including downloaders known as HARDTACK and SHIPBREAD and FrameworkPOS.
It malware has created scheduled tasks to establish persistence.
It has used scheduled tasks to maintain RDP backdoors.
It has used Scheduled Tasks for persistence and to load and execute a reverse proxy binary.
During Frankenstein, the threat actors established persistence through a scheduled task using the command: /Create /F /SC DAILY /ST 09:00 /TN WinUpdate /TR, named "WinUpdate"
It established persistence for PoisonIvy by created a scheduled task.
It has created scheduled tasks to launch executables after a designated number of minutes have passed.
Gazer can establish persistence by creating a scheduled task.
GoldMax has used scheduled tasks to maintain persistence.
Goopy has the ability to maintain persistence by creating scheduled tasks set to run every hour.
GravityRAT creates a scheduled task to ensure it is re-executed everyday.
GRIFFON has used sctasks for persistence.
GrimAgent has the ability to set persistence using the Task Scheduler.
Helminth has used a scheduled task for persistence.
HermeticWiper has the ability to use scheduled tasks for execution.
It has used a scheduled task to establish persistence for a keylogger.
It dropped and added officeupdate.exe to scheduled tasks.
HotCroissant has attempted to install a scheduled task named "Java Maintenance64" on startup to establish persistence.
IcedID has created a scheduled task that executes every hour to establish persistence.
InvisiMole has used scheduled tasks named MSST and \Microsoft\Windows\Autochk\Scheduled to establish persistence.
IronNetInjector has used a task XML file named mssch.xml to run an IronPython script when a user logs in or when specific system events are created.
ISMInjector creates scheduled tasks to establish persistence.
JHUHUGIT has registered itself as a scheduled task to run each time the current user logs in.
JSS Loader has the ability to launch scheduled tasks to establish persistence.
It has downloaded additional malware with scheduled tasks.
Koadic has used scheduled tasks to add persistence.
It has used schtasks for persistence including through the periodic execution of a remote XSL script or a dropped VBS payload.
LitePower can create a scheduled task to enable persistence mechanisms.
Lokibot embedded the commands schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I inside a batch script.
Lucifer has established persistence by creating the following scheduled task schtasks /create /sc minute /mo 1 /tn QQMusic ^ /tr C:Users\%USERPROFILE%\Downloads\spread.exe /F.
It has created scheduled tasks to establish persistence for their tools.
The different components of It are executed by Windows Task Scheduler.
It has created scheduled tasks to maintain It's persistence.
It has used scheduled tasks to establish persistence and execution.
Matryoshka can establish persistence by adding a Scheduled Task named "Microsoft Boost Kernel Optimization".
Maze has created scheduled tasks using name variants such as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update", to launch Maze at a specific time.
MCMD can use scheduled tasks for persistence.
It has used a script (atexec.py) to execute a command on a target machine via Task Scheduler.
Meteor execution begins from a scheduled task named Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeAll and it creates a separate scheduled task called mstask to run the wiper only once at 23:55:00.
Milan can establish persistence on a targeted host with scheduled tasks.
It has created scheduled tasks to persistently run VBScripts.
It has used scheduled tasks to establish persistence.
It has created a scheduled task to execute additional malicious software, as well as maintain persistence.
It has used schtasks.exe for lateral movement in compromised networks.
NETWIRE can create a scheduled task to establish persistence.
NotPetya creates a task to reboot the system one hour after infection.
It has created scheduled tasks that run a VBScript to execute a payload on victim machines.
Okrum's installer can attempt to achieve persistence by creating a scheduled task.
OopsIE creates a scheduled task to run itself every three minutes.
During Operation CuckooBees, the threat actors used scheduled tasks to execute batch scripts for lateral movement with the following command: SCHTASKS /Create /S <IP Address> /U <Username> /p <Password> /SC ONCE /TN test /TR <Path to a Batch File> /ST <Time> /RU SYSTEM.
During Operation Dream Job, It created scheduled tasks to set a periodic execution of a remote XSL script.
During Operation Wocao, threat actors used scheduled tasks to execute malicious PowerShell code on remote systems.
A It file stealer can run a TaskScheduler DLL to add persistence.
PowerSploit's New-UserPersistenceOption Persistence argument can be used to establish via a Scheduled Task/Job.
POWERSTATS has established persistence through a scheduled task using the command "C:\Windows\system32\schtasks.exe" /Create /F /SC DAILY /ST 12:00 /TN MicrosoftEdge /TR "c:\Windows\system32\wscript.exe C:\Windows\temp\Windows.vbe".
POWRUNER persists through a scheduled task that executes it every minute.
Prestige has been executed on a target system through a scheduled task created by It using Impacket.
Pteranodon schedules tasks to invoke its components in order to establish persistence.
QakBot has the ability to create scheduled tasks for persistence.
QUADAGENT creates a scheduled task to maintain persistence on the victim’s machine.
QuasarRAT contains a .NET wrapper DLL for creating and managing scheduled tasks for maintaining persistence upon reboot.
RainyDay can use scheduled tasks to achieve persistence.
Ramsay can schedule tasks via the Windows COM API to maintain persistence.
It launched a scheduled task to gain persistence using the schtasks /create /sc command.
Remexi utilizes scheduled tasks as a persistence mechanism.
RemoteCMD can execute commands remotely by creating a new schedule task on the remote system
Revenge RAT schedules tasks to run malicious scripts at different intervals.
It tries to add a scheduled task to establish persistence.
Ryuk can remotely create a scheduled task to execute itself on a system.
Saint Bot has created a scheduled task named "Maintenance" to establish persistence.
schtasks is used to schedule tasks on a Windows system to run at a specific date and time.
ServHelper contains modules that will use schtasks to carry out malicious operations.
Shamoon copies an executable payload to the target system by using SMB/Windows Admin Shares and then scheduling an unnamed task to execute the malware.
SharpDisco can create scheduled tasks to execute reverse shells that read and write data to and from specified SMB shares.
SharpStage has a persistence component to write a scheduled task for the payload.
Sibot has been executed via a scheduled task.
It has used scheduled tasks to stage its operation.
Smoke Loader launches a scheduled task.
During the SolarWinds Compromise, It used scheduler and schtasks to create new tasks on remote host as part of their lateral movement. They manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration. It also created a scheduled task to maintain SUNSPOT persistence when the host booted.
SoreFang can gain persistence through use of scheduled tasks.
SQLRat has created scheduled tasks in %appdata%\Roaming\Microsoft\Templates\.
It malware creates a scheduled task entitled "IE Web Cache" to execute a malicious file hourly.
Stuxnet schedules a network job to execute two minutes after host infection.
SUGARDUMP has created scheduled tasks called MicrosoftInternetExplorerCrashRepoeterTaskMachineUA and MicrosoftEdgeCrashRepoeterTaskMachineUA, which were configured to execute CrashReporter.exe during user logon.
SVCReady can create a scheduled task named RecoveryExTask to gain persistence.
It has used scheduled tasks to establish persistence for installed tools.
Tarrask is able to create "hidden" scheduled tasks for persistence.
It has used scheduled task XML triggers.
Tomiris has used SCHTASKS /CREATE /SC DAILY /TN StartDVL /TR "[path to self]" /ST 10:00 to establish persistence.
TrickBot creates a scheduled task on the system that provides persistence.
Valak has used scheduled tasks to execute additional payloads and to gain persistence on a compromised host.
It has used scheduled tasks to establish persistence for TrickBot and other malware.
yty establishes persistence by creating a scheduled task with the command SchTasks /Create /SC DAILY /TN BigData /TR " + path_file + "/ST 09:30".
Zebrocy has a command to create a scheduled task for persistence.
zwShell has used SchTasks for execution.
ZxxZ has used scheduled tasks for persistence and execution.