TA0002 · EXECUTION
Scheduled Task/Job
schtasks, cron, at, and systemd timers used both to execute now and to survive a reboot.
Detect it with
Event ID 4698 (task created); new cron entries; tasks whose action points at a user-writable path.
Why it matters on shift
Scheduled Task/Job is one of the concrete ways adversaries achieve execution. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After execution, the next tactic is usually Persistence. Search your telemetry for the transition before closing the ticket.
5 sub-techniques
How it shows up in practice
- T1053.002
At
Adversaries may abuse the at utility to perform task scheduling for initial or recurring execution of malicious code. The at utility exists as an executable within Windows, Linux, and macOS for scheduling tasks at a specified time and date.
- T1053.003
Cron
Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code. The cron utility is a time-based job scheduler for Unix-like operating systems.
- T1053.005
Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows.
- T1053.006
Systemd Timers
Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. Systemd timers are unit files with file extension .timer that control services.
- T1053.007
Container Orchestration Job
Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code.
Kill-chain context