sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
Rclone can exfiltrate data over FTP or HTTP, including HTTP via WebDAV.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
Remsec can exfiltrate data via a DNS tunnel or email, separately from its C2 channel.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
SocGholish can exfiltrate data directly to its C2 domain via HTTP.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
WARPWIRE can send captured credentials to C2 via HTTP `GET` or `POST` requests.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
WindTail has the ability to automatically exfiltrate files using the macOS built-in utility /usr/bin/curl.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
ccf32 can upload collected data and files to an FTP server.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
ftp may be used to exfiltrate data separate from the main command and control protocol.
Technique: T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Tactic: TA0010 Exfiltration
During FunnyDream, the threat actors used netstat to discover network connections on remote systems.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
During Operation CuckooBees, the threat actors used the `net session`, `net use`, and `netstat` commands as part of their advanced reconnaissance.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
During Operation Wocao, threat actors collected a list of open connections on the infected system using `netstat` and checks whether it has an internet connection.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
APT1 used the `net use` command to get a listing on network connections.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
APT3 has a tool that can enumerate current network connections.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
APT32 used the `netstat -anpo tcp` command to display TCP connections on the victim's machine.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
APT38 installed a port monitoring tool, MAPMAKER, to print the active TCP connections on the local system.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
APT41 has enumerated IP addresses of network resources and used the `netstat` command as part of network reconnaissance. The group has also used a malware variant, HIGHNOON, to enumerate active RDP sessions.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
APT5 has used the BLOODMINE utility to collect data on web requests from Pulse Secure Connect logs.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Andariel has used the `netstat -naop tcp` command to display TCP connections on a victim's machine.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
BackdoorDiplomacy has used NetCat and PortQry  to enumerate network connections and display the status of related TCP and UDP ports.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Chimera has used `netstat -ano | findstr EST` to discover network connections.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Earth Lusca employed a PowerShell script called RDPConnectionParser to read and filter the Windows event log “Microsoft-Windows-TerminalServices-RDPClient/Operational”
(Event ID 1024) to obtain network information from RDP connections. Earth Lusca has also used netstat from a compromised system to obtain network connection information.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
FIN13 has used `netstat` and other net  commands for network reconnaissance efforts.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
GALLIUM used `netstat -oan` to obtain information about the victim network connections.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
HEXANE has used netstat to monitor connections to specific ports.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Ke3chang performs local network connection discovery using `netstat`.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Lazarus Group has used `net use` to identify and establish a network connection with a remote host.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Magic Hound has used quser.exe to identify existing RDP connections.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
MuddyWater has used a PowerShell backdoor to check for Skype connections on the target machine.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Mustang Panda has used `netstat -ano` to determine network connection information.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
OilRig has used `netstat -an` on a victim to get a listing of network connections.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Poseidon Group obtains and saves information about victim network interfaces and addresses.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Sandworm Team had gathered user, IP address, and server data related to RDP sessions on a compromised host. It has also accessed network diagram files useful for understanding how a host's network was configured.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
TeamTNT has run `netstat -anp` to search for rival malware connections. TeamTNT has also used `libprocesshider` to modify `/etc/ld.so.preload`.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Threat Group-3390 has used `net use` and `netstat` to conduct internal discovery of systems. The group has also used `quser.exe` to identify existing RDP sessions on a victim.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
ToddyCat has used `netstat -anop tcp` to discover TCP connections to compromised hosts.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Tropic Trooper has tested if the localhost network is available and other connection capability on an infected system using command scripts.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Turla surveys a system upon check-in to discover active local network connections using the `netstat -an`, `net use`, `net file`, and `net session` commands. Turla RPC backdoors have also enumerated the IPv4 TCP connection table via the `GetTcpTable2` API call.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Volt Typhoon has used `netstat -ano` on compromised hosts to enumerate network connections.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to display network connections: `netstat -ano >> %temp%\download`
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
menuPass has used `net use` to conduct connectivity checks to machines.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Aria-body has the ability to gather TCP and UDP table status listings.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
BADHATCH can execute `netstat.exe -f` on a compromised machine.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Babuk can use “WNetOpenEnumW” and “WNetEnumResourceW” to enumerate files in network resources for encryption.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
BlackEnergy has gathered information about local network connections using netstat.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Carbon uses the `netstat -r` and `netstat -an` commands.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
CharmPower can use `netsh wlan show profiles` to list specific Wi-Fi profile details.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Cobalt Strike can produce a sessions report from compromised hosts.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Comnie executes the `netstat -ano` command.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Conti can enumerate routine network connections from a compromised host.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
CrackMapExec can discover active sessions for a targeted system.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Cuba can use the function `GetIpNetTable` to recover the last connections to the victim's machine.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Dtrack can collect network and active connection information.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
The discovery modules used with Duqu can collect information on network connections.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Egregor can enumerate all connected drives.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Empire can enumerate the current network connections of a host.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Epic uses the `net use`, `net session`, and `netstat` commands to gather information on network connections.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Flagpro has been used to execute `netstat -ano` on a compromised host.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
GravityRAT uses the `netstat` command to find open ports on the victim’s machine.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
KONNI has used `net session` on the victim's machine.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
KOPILUWAK can use netstat, Arp, and Net to discover current TCP connections.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Kwampirs collects a list of active and listening connections by using the command `netstat -nao` as well as a list of available network mappings with `net use`.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Lizar has a plugin to retrieve information about all active network sessions on the infected server.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Lucifer can identify the IP and port numbers for all remote connections from the compromised host.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
After loading the keyword and phone data files, MESSAGETAP begins monitoring all network connections to and from the victim server.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Machete uses the `netsh wlan show networks mode=bssid` and `netsh wlan show interfaces` commands to list all nearby WiFi networks and connected interfaces.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Mafalda can use the `GetExtendedTcpTable` function to retrieve information about established TCP connections.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Maze has used the "WNetOpenEnumW", "WNetEnumResourceW”, “WNetCloseEnum” and “WNetAddConnection2W” functions to enumerate the network resources on the infected machine.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
NETWIRE can capture session logon details from a compromised host.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Commands such as `net use` and `net session` can be used in Net to gather information about network connections from a particular host.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
OSInfo enumerates the current network connections similar to ` net use `.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Okrum was seen using NetSess to discover NetBIOS sessions.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
POWRUNER may collect active network connections by running `netstat -an` on a victim.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Once inside a Virtual Private Cloud, Pacu can attempt to identify DirectConnect, VPN, or VPC Peering.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
PlugX has a module for enumerating TCP and UDP network connections and associated processes using the `netstat` command.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
PoshC2 contains an implementation of netstat to enumerate TCP and UDP connections.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Pupy has a built-in utility command for `netstat`, can do net session through PowerView, and has an interactive shell which can be used to discover additional information.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
PyDCrypt has used netsh to find RPC connections on remote machines.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
QakBot can use `netstat` to enumerate current network connections.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
RATANKBA uses `netstat -ano` to search for specific IP address ranges.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Ramsay can use `netstat` to enumerate network connections.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
RedLeaves can enumerate drives and Remote Desktop sessions.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Remsec can obtain a list of active connections and open ports.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
SHOTPUT uses netstat to list TCP connection status.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
SLOTHFULMEDIA can enumerate open ports on a victim machine.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Sardonic has the ability to execute the `netstat` command.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
ShimRatReporter used the Windows function `GetExtendedUdpTable` to detect connected UDP endpoints.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Sibot has retrieved a GUID associated with a present LAN connection on a compromised machine.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Sliver can collect network connection information.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
SpeakUp uses the `arp -a` command.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Sykipot may use `netstat -ano` to display active network connections.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Torisma can use `WTSEnumerateSessionsW` to monitor remote desktop connections.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Trojan.Karagany can use netstat to collect a list of network connections.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
USBferry can use `netstat` and `nbtstat` to detect active network connections.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Volgmer can gather information about TCP connection state.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Waterbear can use API hooks on `GetExtendedTcpTable` to retrieve a table containing a list of TCP endpoints available to the application.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Zebrocy uses `netstat -aon` to gather network connection information.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
jRAT can list network connections.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
nbtstat can be used to discover current NetBIOS sessions.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
netstat can be used to enumerate local network connections, including active TCP connections and other network statistics.
Technique: T1049 System Network Connections Discovery, Tactic: TA0007 Discovery
Mustang Panda has used a customized PlugX variant which could exfiltrate documents from air-gapped networks.
Technique: T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB, Tactic: TA0010 Exfiltration
Tropic Trooper has exfiltrated data using USB storage devices.
Technique: T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB, Tactic: TA0010 Exfiltration
Agent.btz creates a file named thumb.dd on all USB flash drives connected to the victim. This file contains information about the infected system and activity logs.
Technique: T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB, Tactic: TA0010 Exfiltration
Machete has a feature to copy files from every drive onto a removable drive in a hidden folder.
Technique: T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB, Tactic: TA0010 Exfiltration
Remsec contains a module to move data from airgapped networks to Internet-connected systems by using a removable USB device.
Technique: T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB, Tactic: TA0010 Exfiltration
SPACESHIP copies staged data to removable drives when they are inserted into the system.
Technique: T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB, Tactic: TA0010 Exfiltration
USBStealer exfiltrates collected files via removable media from air-gapped victims.
Technique: T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB, Tactic: TA0010 Exfiltration
Earth Lusca used the command `schtasks /Create /SC ONLOgon /TN WindowsUpdateCheck /TR “[file path]” /ru system` for persistence.
Technique: T1053 Scheduled Task/Job, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
DEADEYE has used the scheduled tasks `\Microsoft\Windows\PLA\Server Manager Performance Monitor`, `\Microsoft\Windows\Ras\ManagerMobility`, `\Microsoft\Windows\WDI\SrvSetupResults`, and `\Microsoft\Windows\WDI\USOShared`
 to establish persistence.
Technique: T1053 Scheduled Task/Job, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Lokibot's second stage DLL has set a timer using “timeSetEvent” to schedule its next execution.
Technique: T1053 Scheduled Task/Job, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Remsec schedules the execution one of its modules by creating a new scheduler task.
Technique: T1053 Scheduled Task/Job, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
StrifeWater has create a scheduled task named `Mozilla\Firefox Default Browser Agent 409046Z0FF4A39CB` for persistence.
Technique: T1053 Scheduled Task/Job, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
APT18 actors used the native at Windows task scheduler tool to use scheduled tasks for execution on a victim network.
Technique: T1053.002 Scheduled Task/Job: At, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
BRONZE BUTLER has used at to register a scheduled task to execute malware during lateral movement.
Technique: T1053.002 Scheduled Task/Job: At, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Threat Group-3390 actors use at to schedule tasks to run self-extracting RAR archives, which install HTTPBrowser or PlugX on other victims on a network.
Technique: T1053.002 Scheduled Task/Job: At, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
CrackMapExec can set a scheduled task on the target system to execute commands remotely using at.
Technique: T1053.002 Scheduled Task/Job: At, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
MURKYTOP has the capability to schedule remote AT jobs.
Technique: T1053.002 Scheduled Task/Job: At, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
at can be used to schedule a task on a system to be executed at a specific date or time.
Technique: T1053.002 Scheduled Task/Job: At, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
APT38 has used cron to create pre-scheduled and periodic background jobs on a Linux system.
Technique: T1053.003 Scheduled Task/Job: Cron, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
APT5 has made modifications to the crontab file including in `/var/cron/tabs/`.
Technique: T1053.003 Scheduled Task/Job: Cron, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Rocke installed a cron job that downloaded and executed files from the C2.
Technique: T1053.003 Scheduled Task/Job: Cron, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Anchor can install itself as a cron job.
Technique: T1053.003 Scheduled Task/Job: Cron, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Exaramel for Linux uses crontab for persistence if it does not have root privileges.
Technique: T1053.003 Scheduled Task/Job: Cron, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
The GoldMax Linux variant has used a crontab entry with a `@reboot` line to gain persistence.
Technique: T1053.003 Scheduled Task/Job: Cron, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Janicab used a cron job for persistence on Mac devices.
Technique: T1053.003 Scheduled Task/Job: Cron, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Kinsing has used crontab to download and run shell scripts every minute to ensure persistence.
Technique: T1053.003 Scheduled Task/Job: Cron, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
NETWIRE can use crontabs to establish persistence.
Technique: T1053.003 Scheduled Task/Job: Cron, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
NKAbuse uses a Cron job to establish persistence when infecting Linux hosts.
Technique: T1053.003 Scheduled Task/Job: Cron, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Penquin can use Cron to create periodic and pre-scheduled background jobs.
Technique: T1053.003 Scheduled Task/Job: Cron, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Skidmap has installed itself via crontab.
Technique: T1053.003 Scheduled Task/Job: Cron, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
SpeakUp uses cron tasks to ensure persistence.
Technique: T1053.003 Scheduled Task/Job: Cron, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Xbash can create a cronjob for persistence if it determines it is on a Linux system.
Technique: T1053.003 Scheduled Task/Job: Cron, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
During C0017, APT41 used the following Windows scheduled tasks for DEADEYE dropper persistence on US state government networks: `\Microsoft\Windows\PLA\Server Manager Performance Monitor`, `\Microsoft\Windows\Ras\ManagerMobility`, `\Microsoft\Windows\WDI\SrvSetupResults`, and `\Microsoft\Windows\WDI\USOShared`.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
During the C0032 campaign, TEMP.Veles used scheduled task XML triggers.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
During CostaRicto, the threat actors used scheduled tasks to download backdoor tools.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
During Frankenstein, the threat actors established persistence through a scheduled task using the command: `/Create /F /SC DAILY /ST 09:00 /TN WinUpdate /TR`, named "WinUpdate"
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
During Operation CuckooBees, the threat actors used scheduled tasks to execute batch scripts for lateral movement with the following command: `SCHTASKS /Create /S <IP Address> /U <Username> /p <Password> /SC ONCE /TN test /TR <Path to a Batch File> /ST <Time> /RU SYSTEM.`
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
During Operation Dream Job, Lazarus Group created scheduled tasks to set a periodic execution of a remote XSL script.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
During Operation Wocao, threat actors used scheduled tasks to execute malicious PowerShell code on remote systems.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
During the SolarWinds Compromise, APT29 used `scheduler` and `schtasks` to create new tasks on remote host as part of their lateral movement. They manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration. APT29 also created a scheduled task to maintain SUNSPOT persistence when the host booted.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
In the Triton Safety Instrumented System Attack, TEMP.Veles installed scheduled tasks defined in XML files.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
APT29 has used named and hijacked scheduled tasks to establish persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
An APT3 downloader creates persistence by creating the following scheduled task: `schtasks /create /tn "mysc" /tr C:\Users\Public\test.exe /sc ONLOGON /ru "System"`.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
APT32 has used scheduled tasks to persist on victim systems.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
APT33 has created a scheduled task to execute a .vbe file multiple times a day.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
APT37 has created scheduled tasks to run malicious scripts on a compromised host.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
APT38 has used Task Scheduler to run programs at system startup or on a scheduled basis for persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
APT39 has created scheduled tasks for persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
APT41 used a compromised account to create a scheduled task on a system.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
BITTER has used scheduled tasks for persistence and execution.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
BRONZE BUTLER has used schtasks to register a scheduled task to execute malware during lateral movement.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Blue Mockingbird has used Windows Scheduled Tasks to establish persistence on local and remote hosts.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Chimera has used scheduled tasks to invoke Cobalt Strike including through batch script `schtasks /create /ru "SYSTEM" /tn "update" /tr "cmd /c c:\windows\temp\update.bat" /sc once /f /st` and to maintain persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Cobalt Group has created Windows tasks to establish persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Confucius has created scheduled tasks to maintain persistence on a compromised host.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Dragonfly has used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
FIN10 has established persistence by using S4U tasks as well as the Scheduled Task option in PowerShell Empire.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
FIN13 has created scheduled tasks in the `C:\Windows` directory of the compromised network.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
FIN6 has used scheduled tasks to establish persistence for various malware it uses, including downloaders known as HARDTACK and SHIPBREAD and FrameworkPOS.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
FIN7 malware has created scheduled tasks to establish persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
FIN8 has used scheduled tasks to maintain RDP backdoors.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Fox Kitten has used Scheduled Tasks for persistence and to load and execute a reverse proxy binary.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
GALLIUM established persistence for PoisonIvy by created a scheduled task.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Gamaredon Group has created scheduled tasks to launch executables after a designated number of minutes have passed.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
HEXANE has used a scheduled task to establish persistence for a keylogger.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Higaisa dropped and added `officeupdate.exe` to scheduled tasks.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Kimsuky has downloaded additional malware with scheduled tasks.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Lazarus Group has used `schtasks` for persistence including through the periodic execution of a remote XSL script or a dropped VBS payload.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
LuminousMoth has created scheduled tasks to establish persistence for their tools.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Machete has created scheduled tasks to maintain Machete's persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Magic Hound has used scheduled tasks to establish persistence and execution.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Molerats has created scheduled tasks to persistently run VBScripts.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
MuddyWater has used scheduled tasks to establish persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Mustang Panda has created a scheduled task to execute additional malicious software, as well as maintain persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Naikon has used schtasks.exe for lateral movement in compromised networks.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
OilRig has created scheduled tasks that run a VBScript to execute a payload on victim machines.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
A Patchwork file stealer can run a TaskScheduler DLL to add persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Rancor launched a scheduled task to gain persistence using the `schtasks /create /sc` command.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Silence has used scheduled tasks to stage its operation.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Stealth Falcon malware creates a scheduled task entitled “IE Web Cache” to execute a malicious file hourly.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
TA2541 has used scheduled tasks to establish persistence for installed tools.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
ToddyCat has used scheduled tasks to execute discovery commands and scripts for collection.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Wizard Spider has used scheduled tasks to establish persistence for TrickBot and other malware.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
menuPass has used a script (atexec.py) to execute a command on a target machine via Task Scheduler.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Agent Tesla  has achieved persistence via scheduled tasks.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Anchor can create a scheduled task for persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
AppleJeus has created a scheduled SYSTEM task that runs when a user logs in.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
AsyncRAT can create a scheduled task to maintain persistence on system start-up.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Attor's installer plugin can schedule a new task that loads the dispatcher on boot/logon.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
BADHATCH can use `schtasks.exe` to gain persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
BADNEWS creates a scheduled task to establish by executing a malicious payload every subsequent minute.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
BONDUPDATER persists using a scheduled task that executes every minute.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
BabyShark has used scheduled tasks to maintain persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
BackConfig has the ability to use scheduled tasks to repeatedly execute malicious payloads on a compromised host.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Bad Rabbit’s `infpub.dat` file creates a scheduled task to launch a malicious executable.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Bazar can create a scheduled task for persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Bumblebee can achieve persistence by copying its DLL to a subdirectory of %APPDATA% and creating a Visual Basic Script that will load the DLL via a scheduled task.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
CSPY Downloader can use the schtasks utility to bypass UAC.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Carbon creates several tasks for later execution to continue persistence on the victim’s machine.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
ComRAT has used a scheduled task to launch its PowerShell loader.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
CosmicDuke uses scheduled tasks typically named "Watchmon Service" for persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
One persistence mechanism used by CozyCar is to register itself as a scheduled task.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Crutch has the ability to persist using scheduled tasks.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
DanBot can use a scheduled task for installation.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
DarkWatchman has created a scheduled task for persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Disco can create a scheduled task to run every minute for persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Dridex can maintain persistence via the creation of scheduled tasks within system directories such as `windows\system32\`, `windows\syswow64,` `winnt\system32`, and `winnt\syswow64`.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Dyre has the ability to achieve persistence by adding a new task in the task scheduler to run every minute.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Emotet has maintained persistence through a scheduled task.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Empire has modules to interact with the Windows task scheduler.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
EvilBunny has executed commands via scheduled tasks.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
GRIFFON has used `sctasks` for persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Gazer can establish persistence by creating a scheduled task.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
GoldMax has used scheduled tasks to maintain persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Goopy has the ability to maintain persistence by creating scheduled tasks set to run every hour.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
GravityRAT creates a scheduled task to ensure it is re-executed everyday.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
GrimAgent has the ability to set persistence using the Task Scheduler.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Helminth has used a scheduled task for persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
HermeticWiper has the ability to use scheduled tasks for execution.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
HotCroissant has attempted to install a scheduled task named “Java Maintenance64” on startup to establish persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
ISMInjector creates scheduled tasks to establish persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
IcedID has created a scheduled task that executes every hour to establish persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
InvisiMole has used scheduled tasks named `MSST` and `\Microsoft\Windows\Autochk\Scheduled` to establish persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
IronNetInjector has used a task XML file named `mssch.xml` to run an IronPython script when a user logs in or when specific system events are created.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
JHUHUGIT has registered itself as a scheduled task to run each time the current user logs in.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
JSS Loader has the ability to launch scheduled tasks to establish persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Koadic has used scheduled tasks to add persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
LitePower can create a scheduled task to enable persistence mechanisms.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Lokibot embedded the commands `schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I` inside a batch script.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Lucifer has established persistence by creating the following scheduled task `schtasks /create /sc minute /mo 1 /tn QQMusic ^ /tr C:Users\%USERPROFILE%\Downloads\spread.exe /F`.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
MCMD can use scheduled tasks for persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
The different components of Machete are executed by Windows Task Scheduler.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Matryoshka can establish persistence by adding a Scheduled Task named "Microsoft Boost Kernel Optimization".
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Maze has created scheduled tasks using name variants such as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update", to launch Maze at a specific time.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Meteor execution begins from a scheduled task named `Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeAll` and it creates a separate scheduled task called `mstask` to run the wiper only once at 23:55:00.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Milan can establish persistence on a targeted host with scheduled tasks.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
NETWIRE can create a scheduled task to establish persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation