T1053.005: Scheduled Task

Execution Intelligence Profile

AI Answer

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The [schtasks](https://attack.mitre.org/software/S0111) utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools (Source: MITRE ATT&CK T1053.005)

Confidence: 0.9 · Source: MITRE ATT&CK · Requires review: yes · Freshness: 2026-09-07

ATT&CK Mapping

Field	Value
Technique ID	T1053.005
Name	Scheduled Task
Tactic	Execution (execution)
Platforms	Windows
Sub-technique	Yes

Why it matters

In the OpenTrojan knowledge graph, Scheduled Task (T1053.005) is one of the highest-connectivity ATT&CK techniques: 190 MITRE STIX relationships reference this technique; 54 threat groups observed using it; 124 software families associated; 12 campaigns associated. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.

How attackers use it

Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1053.005). Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet Invoke-CimMethod, which leverages WMI class PS_ScheduledTask to create a scheduled task via an XML path. An adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence. The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and/or to run a process under the context of a specified account (such as SYSTEM). Similar to System Binary Proxy Execution, adversaries have also abused the Windows Task Scheduler to potentially mask one-time execution under signed/trusted system processes. Adversaries may also create “hidden” scheduled tasks (i.e. Hide Artifacts) that may not be visible to defender tools and manual queries used to enumerate tasks. Specifically, an adversary may hide a task from schtasks /query and the Task Scheduler by deleting the associated Security Descriptor (SD) registry value (where deletion of this value must be completed using SYSTEM permissions). Adversaries may also employ alternate methods to hide tasks, such as altering the metadata (e.g., Index value) within associated registry keys.

Detection

Not available — MITRE ATT&CK does not currently publish a structured detection strategy for this technique in the ingested dataset.

Mitigation

Operating System Configuration involves adjusting system settings and hardening the default configurations of an operating system (OS) to mitigate adversary exploitation and prevent abuse of system functionality. Proper OS configurations address security vulnerabilities, limit attack surfaces, and ensure robust defense against a wide range of techniques. This mitigation can be implemented through the following measures:

Disable Unused Features:

Turn off SMBv1, LLMNR, and NetBIOS where not needed.
Disable remote registry and unnecessary services.

Enforce OS-level Protections:

Enable Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Control Flow Guard (CFG) on Windows.
Use AppArmor or SELinux on Linux for mandatory access controls.

Secure Access Settings:

Enable User Account Control (UAC) for Windows.
Restrict root/sudo access on Linux/macOS and enforce strong permissions using sudoers files.

File System Hardening:

Implement least-privilege access for critical files and system directories.
Audit permissions regularly using tools like icacls (Windows) or getfacl/chmod (Linux/macOS).

Secure Remote Access:

Restrict RDP, SSH, and VNC to authorized IPs using firewall rules.
Enable NLA for RDP and enforce strong password/lockout policies.

Harden Boot Configurations:

Enable Secure Boot and enforce UEFI/BIOS password protection.
Use BitLocker or LUKS to encrypt boot drives.

Regular Audits:

Periodically audit OS configurations using tools like CIS Benchmarks or SCAP tools.

Tools for Implementation

Windows:

Microsoft Group Policy Objects (GPO): Centrally enforce OS security settings.
Windows Defender Exploit Guard: Built-in OS protection against exploits.
CIS-CAT Pro: Audit Windows security configurations based on CIS Benchmarks.

Linux/macOS:

AppArmor/SELinux: Enforce mandatory access controls.
Lynis: Perform comprehensive security audits.
SCAP Security Guide: Automate configuration hardening using Security Content Automation Protocol.

Cross-Platform:

Ansible or Chef/Puppet: Automate configuration hardening at scale.
OpenSCAP: Perform compliance and configuration checks.

Mitigation guidance is from the MITRE ATT&CK course-of-action associated with this technique.

TrickBot
Bumblebee
GRIFFON
yty
Stuxnet
POWRUNER
SharpStage
Smoke Loader
Matryoshka
GravityRAT
Prestige
SharpDisco

Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).

APT38
BlackByte
GALLIUM
APT3
Kimsuky
Patchwork
APT41
Dragonfly
menuPass
APT32
MuddyWater
Naikon

Group associations are from MITRE ATT&CK STIX relationships.

Operation Dream Job
SharePoint ToolShell Exploitation
Frankenstein
Triton Safety Instrumented System Attack
Juicy Mix
C0032
SolarWinds Compromise
Operation CuckooBees
Operation Wocao
C0017
2022 Ukraine Electric Power Attack
CostaRicto

Campaign associations are from MITRE ATT&CK STIX relationships.

References

Source Attribution

Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review

Start Investigation

Move from reading to investigating T1053.005 Scheduled Task. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about T1053.005 Scheduled Task?
Evidence — assertions mapped to verifiable references.
Timeline — events in chronological order.
Related Entities — CVE, threat actor, campaign, malware links.
Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.

Start Investigation Open Workspace