T1053.md

T1053 - Scheduled Task

Description from ATT&CK

Utilities such as [at](https://attack.mitre.org/software/S0110) and [schtasks](https://attack.mitre.org/software/S0111), along with the Windows Task Scheduler, can be used to schedule programs or scripts to be executed at a date and time. A task can also be scheduled on a remote system, provided the proper authentication is met to use RPC and file and printer sharing is turned on. Scheduling a task on a remote system typically required being a member of the Administrators group on the remote system. (Citation: TechNet Task Scheduler Security)

An adversary may use task scheduling to execute programs at system startup or on a scheduled basis for persistence, to conduct remote Execution as part of Lateral Movement, to gain SYSTEM privileges, or to run a process under the context of a specified account.

Atomic Tests

• Atomic Test #1 - At.exe Scheduled task

• Atomic Test #2 - Scheduled task Local

• Atomic Test #3 - Scheduled task Remote

• Atomic Test #4 - Powershell Cmdlet Scheduled Task

Atomic Test #1 - At.exe Scheduled task

Executes cmd.exe Note: deprecated in Windows 8+

Supported Platforms: Windows

Attack Commands: Run with command_prompt!

at 13:20 /interactive cmd

Atomic Test #2 - Scheduled task Local

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
task_command	What you want to execute	String	C:\windows\system32\cmd.exe
time	What time 24 Hour	String	72600

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

SCHTASKS /Create /SC ONCE /TN spawn /TR #{task_command} /ST #{time}

Cleanup Commands:

SCHTASKS /Delete /TN spawn /F

Atomic Test #3 - Scheduled task Remote

Create a task on a remote system

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
task_command	What you want to execute	String	C:\windows\system32\cmd.exe
time	What time 24 Hour	String	72600
target	Target	String	localhost
user_name	Username DOMAIN\User	String	DOMAIN\user
password	Password	String	At0micStrong

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

SCHTASKS /Create /S #{target} /RU #{user_name} /RP #{password} /TN "Atomic task" /TR "#{task_command}" /SC daily /ST #{time}

Cleanup Commands:

SCHTASKS /Delete /TN "Atomic task" /F

Atomic Test #4 - Powershell Cmdlet Scheduled Task

Create an atomic scheduled task that leverages native powershell cmdlets. These could be considered "fileless" scheduled task creation.

Supported Platforms: Windows

Attack Commands: Run with powershell!

$Action = New-ScheduledTaskAction -Execute "calc.exe"
$Trigger = New-ScheduledTaskTrigger -AtLogon
$User = New-ScheduledTaskPrincipal -GroupId "BUILTIN\Administrators" -RunLevel Highest
$Set = New-ScheduledTaskSettingsSet
$object = New-ScheduledTask -Action $Action -Principal $User -Trigger $Trigger -Settings $Set
Register-ScheduledTask AtomicTask -InputObject $object

Cleanup Commands:

Unregister-ScheduledTask -TaskName "AtomicTask" -confirm:$false >$null 2>&1