{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1053","id":"T1053","name":"Scheduled Task/Job","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1053","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"9f328d026b5e720305c6716fe510233f161555192198c0d1f75db30cfe6ee4f5","description":"Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.(Citation: TechNet Task Scheduler Security)\n\nAdversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges). Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.(Citation: ProofPoint Serpent)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1053","external_id":"T1053"},{"source_name":"ProofPoint Serpent","description":"Campbell, B. et al. (2022, March 21). Serpent, No Swiping! New Backdoor Targets French Entities with Unique Attack Chain. Retrieved April 11, 2022.","url":"https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain"},{"source_name":"TechNet Task Scheduler Security","description":"Microsoft. (2005, January 21). Task Scheduler and security. Retrieved June 8, 2016.","url":"https://technet.microsoft.com/en-us/library/cc785125.aspx"}],"platforms":["Containers","ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","containers","network-infrastructure","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1053.002","id":"T1053.002","name":"At","page":"techniques/enterprise/T1053.002/"},{"key":"enterprise/T1053.003","id":"T1053.003","name":"Cron","page":"techniques/enterprise/T1053.003/"},{"key":"enterprise/T1053.005","id":"T1053.005","name":"Scheduled Task","page":"techniques/enterprise/T1053.005/"},{"key":"enterprise/T1053.006","id":"T1053.006","name":"Systemd Timers","page":"techniques/enterprise/T1053.006/"},{"key":"enterprise/T1053.007","id":"T1053.007","name":"Container Orchestration Job","page":"techniques/enterprise/T1053.007/"}],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0061","name":"File Modification","page":"telemetry/DC0061/","kind":"attack_component","category":"Endpoint activity","description":"Changes to file data or attributes.","collection_focus":"Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["path","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0001","name":"Scheduled Job Creation","page":"telemetry/DC0001/","kind":"attack_component","category":"Windows and directory audit","description":"Creation of a scheduled execution object, including its trigger, principal and executable action.","collection_focus":"Enable Audit Other Object Access Events for Windows task creation (4698); retain task XML. For cron/systemd timers, collect scheduler definitions and change events separately.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["task_name","action","principal","schedule","program"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0001","collector":"illustrative-lab-collector","observation":{"task_name":"LabDailyCheck","action":"create","principal":"lab-user","schedule":"daily","program":"lab-check.exe"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."}],"detection":{"key":"enterprise/T1053","id":"T1053","name":"Scheduled Task/Job","domain":"enterprise","platforms":["Containers","ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","containers","network-infrastructure","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1053","technique_page":"techniques/enterprise/T1053/","page":"detections/enterprise/T1053/","status":"rule_source_available","counts":{"sigma":9,"atlas_basic":2,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"0fcd1c79-4eeb-4746-aba9-1b458f7a79cb","title":"Remote Schedule Task Lateral Movement via ATSvc","status":"test","level":"high","logsource":{"product":"rpc_firewall","category":"application","definition":"Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:1ff70682-0a51-30e8-076d-740be8cee98b\""},"data_path":"data/detection-rules/0fcd1c79-4eeb-4746-aba9-1b458f7a79cb.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/rpc_firewall/rpc_firewall_atsvc_lateral_movement.yml","author":"Sagie Dulce, Dekel Paz","kind":"sigma"},{"id":"ace3ff54-e7fd-46bd-8ea0-74b49a0aca1d","title":"Remote Schedule Task Lateral Movement via ITaskSchedulerService","status":"test","level":"high","logsource":{"product":"rpc_firewall","category":"application","definition":"Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:86d35949-83c9-4044-b424-db363231fd0c\""},"data_path":"data/detection-rules/ace3ff54-e7fd-46bd-8ea0-74b49a0aca1d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/rpc_firewall/rpc_firewall_itaskschedulerservice_lateral_movement.yml","author":"Sagie Dulce, Dekel Paz","kind":"sigma"},{"id":"aff229ab-f8cd-447b-b215-084d11e79eb0","title":"Remote Schedule Task Lateral Movement via SASec","status":"test","level":"high","logsource":{"product":"rpc_firewall","category":"application","definition":"Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:378e52b0-c0a9-11cf-822d-00aa0051e40f\""},"data_path":"data/detection-rules/aff229ab-f8cd-447b-b215-084d11e79eb0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/rpc_firewall/rpc_firewall_sasec_lateral_movement.yml","author":"Sagie Dulce, Dekel Paz","kind":"sigma"},{"id":"671ffc77-50a7-464f-9e3d-9ea2b493b26b","title":"Cisco Modify Configuration","status":"test","level":"medium","logsource":{"product":"cisco","service":"aaa"},"data_path":"data/detection-rules/671ffc77-50a7-464f-9e3d-9ea2b493b26b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/cisco/aaa/cisco_cli_modify_config.yml","author":"Austin Clark","kind":"sigma"},{"id":"80e1f67a-4596-4351-98f5-a9c3efabac95","title":"Suspicious Scheduled Task Write to System32 Tasks","status":"test","level":"high","logsource":{"product":"windows","category":"file_event"},"data_path":"data/detection-rules/80e1f67a-4596-4351-98f5-a9c3efabac95.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_task_write.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"42a993dd-bb3e-48c8-b372-4d6684c4106c","title":"HackTool - CrackMapExec Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/42a993dd-bb3e-48c8-b372-4d6684c4106c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"058f4380-962d-40a5-afce-50207d36d7e2","title":"HackTool - CrackMapExec Execution Patterns","status":"stable","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/058f4380-962d-40a5-afce-50207d36d7e2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution_patterns.yml","author":"Thomas Patzke","kind":"sigma"},{"id":"26488ad0-f9fd-4536-876f-52fea846a2e4","title":"HackTool - SharPersist Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/26488ad0-f9fd-4536-876f-52fea846a2e4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_sharpersist.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"4720b7df-40c3-48fd-bbdf-fd4b3c464f0d","title":"Scheduled TaskCache Change by Uncommon Program","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/4720b7df-40c3-48fd-bbdf-fd4b3c464f0d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_taskcache_entry.yml","author":"Syed Hasan (@syedhasan009)","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1053-1","technique_id":"T1053","title":"T1053 Scheduled Task/Job","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#execution","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":65,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L65","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"94b5648ba9516eb1dcaf5ae91052f5f1528f9721d2373851a48ec2aa1ff486b0","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(task_created_or_modified) AND task_action NOT_IN approved_task_actions -> ALERT","log_sources":[{"title":"Scheduled Task and Job Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#17-scheduled-task-and-job-logs"},{"title":"Windows Task Scheduler Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#28-windows-task-scheduler-logs"}]},{"id":"atlas-basic-t1053-2","technique_id":"T1053","title":"T1053 Scheduled Task/Job","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#persistence","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":76,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L76","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"6056223d14d984798152541809090e99ac797bd69e37ea6df5339bdb8eb51d4e","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(task_created_or_modified) AND creator NOT_IN approved_schedulers -> ALERT","log_sources":[{"title":"Scheduled Task and Job Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#17-scheduled-task-and-job-logs"},{"title":"Windows Task Scheduler Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#28-windows-task-scheduler-logs"},{"title":"Linux Service-Manager Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#34-linux-service-manager-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1053-1","technique_id":"T1053","title":"Scheduled job, service, or automation executes payload — T1053 Scheduled Task/Job","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#scheduled-execution","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":46,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L46","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"90f52664f541b6ff7e17c25dee81f40d87f83dc9304564d18156f7fcb192183d","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"scheduled object and resulting process sequence.","expected_behavior":"scheduled objects run consistent actions at recurring times.","deviation":"new action, new owner, phase change, or unexpected task-to-process transition.","anomaly_types":[{"title":"Phase Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#28-phase-anomaly"},{"title":"Transition Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#61-transition-anomaly"},{"title":"Novel-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#85-novel-category-anomaly"}],"log_sources":[{"title":"Scheduled Task and Job Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#17-scheduled-task-and-job-logs"},{"title":"Process Execution Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#6-process-execution-logs"}],"context_references":[{"title":"FortiGuard Incident Response Report H1 2023 — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/fortiguard-ir-h1-2023.pdf"},{"title":"original source","url":"https://www.fortinet.com/content/dam/fortinet/assets/threat-reports/report-fortiguard-incident-response-1h-2023.pdf"}]}],"anomaly_types":[{"title":"Novel-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#85-novel-category-anomaly"},{"title":"Phase Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#28-phase-anomaly"},{"title":"Transition Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#61-transition-anomaly"}],"strategies":[{"id":"DET0094","name":"Cross-Platform Behavioral Detection of Scheduled Task/Job Abuse","url":"https://attack.mitre.org/detectionstrategies/DET0094","stix_id":"x-mitre-detection-strategy--df11466a-27a2-4cb1-bf73-2a3a4aaee0d9","relationship_id":"relationship--9f9f4610-d586-4dff-bbca-282297fd5526","description":"","analytics":[{"id":"AN0258","name":"Analytic 0258","guidance":"Detects creation or modification of scheduled tasks using schtasks.exe, at.exe, or COM objects followed by execution of outlier processes tied to the scheduled job.","url":"https://attack.mitre.org/detectionstrategies/DET0094#AN0258","platforms":["Windows"],"tuning":[{"field":"TaskAuthor","description":"Unexpected user or account context initiating the task."},{"field":"CommandLineRegex","description":"Suspicious binaries or script usage tied to scheduled tasks."},{"field":"ExecutionWindow","description":"Lookback window to correlate process execution after task registration."}],"log_sources":[{"component_id":"DC0001","component":"Scheduled Job Creation","name":"WinEventLog:Security","channel":"EventCode=4698","platforms":["Windows"],"analytic_id":"AN0258","source_url":"https://attack.mitre.org/detectionstrategies/DET0094#AN0258","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0001/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0258","source_url":"https://attack.mitre.org/detectionstrategies/DET0094#AN0258","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0061","component":"File Modification","name":"WinEventLog:Sysmon","channel":"EventCode=2","platforms":["Windows"],"analytic_id":"AN0258","source_url":"https://attack.mitre.org/detectionstrategies/DET0094#AN0258","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"}]},{"id":"AN0259","name":"Analytic 0259","guidance":"Detects creation or modification of cron jobs via crontab, /etc/cron.* directories, or systemd timer units with execution by unusual users or non-standard intervals.","url":"https://attack.mitre.org/detectionstrategies/DET0094#AN0259","platforms":["Linux"],"tuning":[{"field":"CronSchedulePattern","description":"Look for high-frequency or off-hour scheduling patterns."},{"field":"ServiceUser","description":"Unusual users scheduling jobs (e.g., www-data, nobody)."},{"field":"BinaryEntropy","description":"Abnormal scripts or binaries tied to the scheduled job."}],"log_sources":[{"component_id":"DC0061","component":"File Modification","name":"auditd:SYSCALL","channel":"write, rename","platforms":["Linux"],"analytic_id":"AN0259","source_url":"https://attack.mitre.org/detectionstrategies/DET0094#AN0259","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"},{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN0259","source_url":"https://attack.mitre.org/detectionstrategies/DET0094#AN0259","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0001","component":"Scheduled Job Creation","name":"linux:osquery","channel":"crontab, systemd_timers","platforms":["Linux"],"analytic_id":"AN0259","source_url":"https://attack.mitre.org/detectionstrategies/DET0094#AN0259","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0001/"}]},{"id":"AN0260","name":"Analytic 0260","guidance":"Detects creation or alteration of LaunchAgents or LaunchDaemons with corresponding plist modification followed by execution of associated binaries.","url":"https://attack.mitre.org/detectionstrategies/DET0094#AN0260","platforms":["macOS"],"tuning":[{"field":"PlistLabel","description":"Labels not associated with known applications or vendors."},{"field":"LaunchPath","description":"Executable path outside of standard directories (/usr/bin, /Applications)."},{"field":"JobRunInterval","description":"Unexpected periodic job intervals (e.g., every minute)."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"process launch","platforms":["macOS"],"analytic_id":"AN0260","source_url":"https://attack.mitre.org/detectionstrategies/DET0094#AN0260","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0039","component":"File Creation","name":"fs:fsusage","channel":"disk activity on /Library/LaunchAgents or LaunchDaemons","platforms":["macOS"],"analytic_id":"AN0260","source_url":"https://attack.mitre.org/detectionstrategies/DET0094#AN0260","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0001","component":"Scheduled Job Creation","name":"macos:osquery","channel":"launchd_jobs","platforms":["macOS"],"analytic_id":"AN0260","source_url":"https://attack.mitre.org/detectionstrategies/DET0094#AN0260","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0001/"}]},{"id":"AN0261","name":"Analytic 0261","guidance":"Detects unusual use of `cron` or `sleep` loops inside containers executing unfamiliar scripts or binaries repeatedly.","url":"https://attack.mitre.org/detectionstrategies/DET0094#AN0261","platforms":["Containers"],"tuning":[{"field":"ContainerLabel","description":"Labels or tags indicating dev/test containers executing scheduled tasks."},{"field":"ScriptFrequency","description":"Repetitive invocation pattern within short container lifespan."},{"field":"ImageSource","description":"Unexpected container image sources creating cron entries."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Containers"],"analytic_id":"AN0261","source_url":"https://attack.mitre.org/detectionstrategies/DET0094#AN0261","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0061","component":"File Modification","name":"containerd:runtime","channel":"file change monitoring within /etc/cron.*, /tmp, or mounted volumes","platforms":["Containers"],"analytic_id":"AN0261","source_url":"https://attack.mitre.org/detectionstrategies/DET0094#AN0261","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"}]},{"id":"AN0262","name":"Analytic 0262","guidance":"Detects modification of ESXi cron jobs, local.sh scripts, or scheduled API calls to persist custom binaries or shell scripts.","url":"https://attack.mitre.org/detectionstrategies/DET0094#AN0262","platforms":["ESXi"],"tuning":[{"field":"StartupScriptName","description":"Filename not matching expected initialization scripts."},{"field":"ExecutionContext","description":"Commands run from unexpected SSH sessions or elevated shells."},{"field":"PersistenceInterval","description":"Rare scheduling triggers (e.g., @reboot + hourly repetition)."}],"log_sources":[{"component_id":"DC0001","component":"Scheduled Job Creation","name":"esxi:vmkernel","channel":"Startup script and task execution logs","platforms":["ESXi"],"analytic_id":"AN0262","source_url":"https://attack.mitre.org/detectionstrategies/DET0094#AN0262","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0001/"},{"component_id":"DC0064","component":"Command Execution","name":"esxi:hostd","channel":"shell access or job registration","platforms":["ESXi"],"analytic_id":"AN0262","source_url":"https://attack.mitre.org/detectionstrategies/DET0094#AN0262","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0061","component":"File Modification","name":"esxi:cron","channel":"manual edits to /etc/rc.local.d/local.sh or cron.d","platforms":["ESXi"],"analytic_id":"AN0262","source_url":"https://attack.mitre.org/detectionstrategies/DET0094#AN0262","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0061","name":"File Modification","tag":"File Modification","page":"telemetry/DC0061/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0001","name":"Scheduled Job Creation","tag":"Scheduled Job Creation","page":"telemetry/DC0001/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0447","name":"Lokibot","url":"https://attack.mitre.org/software/S0447","kind":"malware","description":"[Lokibot](https://attack.mitre.org/software/S0447)'s second stage DLL has set a timer using “timeSetEvent” to schedule its next execution.(Citation: Talos Lokibot Jan 2021)","relationship_id":"relationship--85b5efa3-9bd0-4685-a211-78f17a3747c7","references":[{"source_name":"Talos Lokibot Jan 2021","description":"Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.","url":"https://blog.talosintelligence.com/2021/01/a-deep-dive-into-lokibot-infection-chain.html"}]}],"actors":[],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Limit privileges of user accounts and remediate Privilege Escalation vectors so only authorized administrators can create scheduled tasks on remote systems.","relationship_id":"relationship--1d50b715-96a2-4fd6-bf92-603ad90730fd","references":[]},{"id":"M1022","name":"Restrict File and Directory Permissions","url":"https://attack.mitre.org/mitigations/M1022","kind":"course-of-action","description":"Restrict access by setting directory and file permissions that are not specific to users or privileged accounts.","relationship_id":"relationship--7a0efacc-7005-4f1e-9fb8-047d8b703cf8","references":[]},{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"Configure the Increase Scheduling Priority option to only allow the Administrators group the rights to schedule a priority process. This can be can be configured through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Increase scheduling priority. (Citation: TechNet Scheduling Priority)","relationship_id":"relationship--8f09085f-c1cf-4321-89c4-17d93e774f6f","references":[{"source_name":"TechNet Scheduling Priority","description":"Microsoft. (2013, May 8). Increase scheduling priority. Retrieved December 18, 2017.","url":"https://technet.microsoft.com/library/dn221960.aspx"}]},{"id":"M1028","name":"Operating System Configuration","url":"https://attack.mitre.org/mitigations/M1028","kind":"course-of-action","description":"Configure settings for scheduled tasks to force tasks to run under the context of the authenticated account instead of allowing them to run as SYSTEM. The associated Registry key is located at <code>HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\SubmitControl</code>. The setting can be configured through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > Security Options: Domain Controller: Allow server operators to schedule tasks, set to disabled. (Citation: TechNet Server Operator Scheduled Task)","relationship_id":"relationship--63c9cdd8-0e64-46dd-9459-3d64828b0cc7","references":[{"source_name":"TechNet Server Operator Scheduled Task","description":"Microsoft. (2012, November 15). Domain controller: Allow server operators to schedule tasks. Retrieved December 18, 2017.","url":"https://technet.microsoft.com/library/jj852168.aspx"}]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Toolkits like the PowerSploit framework contain PowerUp modules that can be used to explore systems for permission weaknesses in scheduled tasks that could be used to escalate privileges. (Citation: Powersploit)","relationship_id":"relationship--9d4e8b44-90f8-4a10-8419-8187d4babf24","references":[{"source_name":"Powersploit","description":"PowerSploit. (n.d.). Retrieved December 4, 2014.","url":"https://github.com/mattifestation/PowerSploit"}]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1218":"/ttp-simulation/techniques/enterprise/T1218/","T1053":"/ttp-simulation/techniques/enterprise/T1053/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1053","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0001","collector":"illustrative-lab-collector","observation":{"task_name":"LabDailyCheck","action":"create","principal":"lab-user","schedule":"daily","program":"lab-check.exe"}}]}}