{"source_checked_on":"2026-10-19","schema_version":1,"key":"mobile/T1603","id":"T1603","name":"Scheduled Task/Job","domain":"mobile","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1603","source_file":{"file":"mobile.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/mobile-attack/mobile-attack-20.0.json","sha256":"824f7d8a37e7893b29e4c6ca6d87b5fbbf3b228ec6384f1a69ee20d523ff59e5","bytes":6095145},"source_object_sha256":"be245ea9db16ad9582fb405779e55b4eb2b7986a581d534f40cafdb3319383c5","description":"Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. On Android and iOS, APIs and libraries exist to facilitate scheduling tasks to execute at a specified date, time, or interval.\n\nOn Android, the `WorkManager` API allows asynchronous tasks to be scheduled with the system. `WorkManager` was introduced to unify task scheduling on Android, using `JobScheduler`, `GcmNetworkManager`, and `AlarmManager` internally. `WorkManager` offers a lot of flexibility for scheduling, including periodically, one time, or constraint-based (e.g. only when the device is charging).(Citation: Android WorkManager)\n\nOn iOS, the `NSBackgroundActivityScheduler` API allows asynchronous tasks to be scheduled with the system. The tasks can be scheduled to be repeating or non-repeating, however, the system chooses when the tasks will be executed. The app can choose the interval for repeating tasks, or the delay between scheduling and execution for one-time tasks.(Citation: Apple NSBackgroundActivityScheduler)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1603","external_id":"T1603"},{"source_name":"Apple NSBackgroundActivityScheduler","description":"Apple. (n.d.). NSBackgroundActivityScheduler. Retrieved November 4, 2020.","url":"https://developer.apple.com/documentation/foundation/nsbackgroundactivityscheduler"},{"source_name":"Android WorkManager","description":"Google. (n.d.). Schedule tasks with WorkManager. Retrieved November 4, 2020.","url":"https://developer.android.com/topic/libraries/architecture/workmanager"}],"platforms":["Android","iOS"],"environments":["mobile"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0021","name":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component","category":"Application and service audit","description":"Instrumented operating-system API calls and their return values.","collection_focus":"Use an approved EDR trace or instrument the owned lab process at selected APIs. Define API name, caller, sanitized arguments and return status.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["process_id","api","path","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0001","name":"Scheduled Job Creation","page":"telemetry/DC0001/","kind":"attack_component","category":"Windows and directory audit","description":"Creation of a scheduled execution object, including its trigger, principal and executable action.","collection_focus":"Enable Audit Other Object Access Events for Windows task creation (4698); retain task XML. For cron/systemd timers, collect scheduler definitions and change events separately.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["task_name","action","principal","schedule","program"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0001","collector":"illustrative-lab-collector","observation":{"task_name":"LabDailyCheck","action":"create","principal":"lab-user","schedule":"daily","program":"lab-check.exe"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."}],"detection":{"key":"mobile/T1603","id":"T1603","name":"Scheduled Task/Job","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"source_url":"https://attack.mitre.org/techniques/T1603","technique_page":"techniques/mobile/T1603/","page":"detections/mobile/T1603/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0707","name":"Detection of Scheduled Task/Job","url":"https://attack.mitre.org/detectionstrategies/DET0707","stix_id":"x-mitre-detection-strategy--ea1efe01-98ef-4a49-a30d-72fde6750985","relationship_id":"relationship--8f15a917-d5e6-4ce3-ab3f-9fe72311f699","description":"","analytics":[{"id":"AN1829","name":"Analytic 1829","guidance":"For Android, detect Scheduled Task/Job primarily during application vetting or controlled analysis rather than assuming a live device SOC feed. Correlate OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App enqueues WorkManager work, schedules JobScheduler job, or sets AlarmManager with repeating interval NOT IN $ApprovedSchedulerApps$]; Scheduled Job Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: Scheduled task execution creates file, accesses sensor, or initiates network connection immediately after firing, with no recent user interaction triggering the task]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.","url":"https://attack.mitre.org/detectionstrategies/DET0707#AN1829","platforms":["Android"],"tuning":[{"field":"ApprovedSchedulerApps","description":"Apps with legitimate scheduled background work: MDM agent (policy sync), email clients (push sync), approved enterprise apps. Derive from MDM catalog. Any unapproved app using repeating scheduled tasks is anomalous."},{"field":"ScheduledIntervalThreshold","description":"Default 900s (15 min) minimum suspicious repeat interval. Shorter intervals indicate high-frequency C2 check-in pattern. Derive from legitimate app scheduler baseline."}],"log_sources":[{"component_id":"DC0021","component":"OS API Execution","name":"mobile:DynamicAnalysis","channel":"Dynamic API/runtime trace: App enqueues WorkManager work, schedules JobScheduler job, or sets AlarmManager with repeating interval NOT IN $ApprovedSchedulerApps$","platforms":["Android"],"analytic_id":"AN1829","source_url":"https://attack.mitre.org/detectionstrategies/DET0707#AN1829","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0021/"},{"component_id":"DC0001","component":"Scheduled Job Creation","name":"mobile:ForensicArtifacts","channel":"Dynamic filesystem trace or acquired app-container/filesystem artifacts: Scheduled task execution creates file, accesses sensor, or initiates network connection immediately after firing, with no recent user interaction triggering the task","platforms":["Android"],"analytic_id":"AN1829","source_url":"https://attack.mitre.org/detectionstrategies/DET0707#AN1829","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0001/"}]},{"id":"AN1830","name":"Analytic 1830","guidance":"For iOS, detect Scheduled Task/Job primarily during application vetting or controlled analysis rather than assuming a live device SOC feed. Correlate OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Managed app creates NSBackgroundActivityScheduler activity or registers BGTask with repeating=true or deferred interval outside $ApprovedSchedulerApps$ function]; Scheduled Job Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: Scheduled task execution produces network, local-write, or sensor artifact while app_state=background or device_locked=true without user trigger]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.","url":"https://attack.mitre.org/detectionstrategies/DET0707#AN1830","platforms":["iOS"],"tuning":[{"field":"ApprovedSchedulerApps","description":"Apps with legitimate scheduled background work: MDM agent (policy sync), email clients (push sync), approved enterprise apps. Derive from MDM catalog. Any unapproved app using repeating scheduled tasks is anomalous."},{"field":"ScheduledIntervalThreshold","description":"Default 900s (15 min) minimum suspicious repeat interval. Shorter intervals indicate high-frequency C2 check-in pattern. Derive from legitimate app scheduler baseline."}],"log_sources":[{"component_id":"DC0021","component":"OS API Execution","name":"mobile:DynamicAnalysis","channel":"Dynamic API/runtime trace: Managed app creates NSBackgroundActivityScheduler activity or registers BGTask with repeating=true or deferred interval outside $ApprovedSchedulerApps$ function","platforms":["iOS"],"analytic_id":"AN1830","source_url":"https://attack.mitre.org/detectionstrategies/DET0707#AN1830","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0021/"},{"component_id":"DC0001","component":"Scheduled Job Creation","name":"mobile:ForensicArtifacts","channel":"Dynamic filesystem trace or acquired app-container/filesystem artifacts: Scheduled task execution produces network, local-write, or sensor artifact while app_state=background or device_locked=true without user trigger","platforms":["iOS"],"analytic_id":"AN1830","source_url":"https://attack.mitre.org/detectionstrategies/DET0707#AN1830","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0001/"}]}]}],"telemetry_references":[{"id":"DC0021","name":"OS API Execution","tag":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component"},{"id":"DC0001","name":"Scheduled Job Creation","tag":"Scheduled Job Creation","page":"telemetry/DC0001/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0536","name":"GPlayed","url":"https://attack.mitre.org/software/S0536","kind":"malware","description":"[GPlayed](https://attack.mitre.org/software/S0536) has used timers to enable Wi-Fi, ping the C2 server, register the device with the C2, and register wake locks on the system.(Citation: Talos GPlayed)","relationship_id":"relationship--373223d8-f18c-4151-8fe0-7d40c0c6e631","references":[{"source_name":"Talos GPlayed","description":"V. Ventura. (2018, October 11).  GPlayed Trojan - .Net playing with Google Market . Retrieved November 24, 2020.","url":"https://blog.talosintelligence.com/2018/10/gplayedtrojan.html"}]},{"id":"S0545","name":"TERRACOTTA","url":"https://attack.mitre.org/software/S0545","kind":"malware","description":"[TERRACOTTA](https://attack.mitre.org/software/S0545) has used timer events in React Native to initiate the foreground service.(Citation: WhiteOps TERRACOTTA)","relationship_id":"relationship--2a1d27a5-8149-4a6c-bbb7-6db83ce3a7ce","references":[{"source_name":"WhiteOps TERRACOTTA","description":"Satori Threat Intelligence and Research Team. (2020, August). TERRACOTTA Android Malware: A Technical Study. Retrieved December 18, 2020.","url":"https://www.whiteops.com/blog/terracotta-android-malware-a-technical-study"}]},{"id":"S0558","name":"Tiktok Pro","url":"https://attack.mitre.org/software/S0558","kind":"malware","description":"[Tiktok Pro](https://attack.mitre.org/software/S0558) has contained an alarm that triggers every three minutes and timers for communicating with the C2.(Citation: Zscaler TikTok Spyware)","relationship_id":"relationship--48c0d9f7-9293-4f38-8ae5-9f5342621f74","references":[{"source_name":"Zscaler TikTok Spyware","description":"S. Desai. (2020, September 8). TikTok Spyware. Retrieved January 5, 2021.","url":"https://www.zscaler.com/blogs/security-research/tiktok-spyware"}]},{"id":"S1083","name":"Chameleon","url":"https://attack.mitre.org/software/S1083","kind":"malware","description":"[Chameleon](https://attack.mitre.org/software/S1083) has used the AlarmManager API to schedule tasks.(Citation: ThreatFabric_Chameleon_Dec2023) ","relationship_id":"relationship--1c307192-0358-4c0c-920e-0fc2d3e86889","references":[{"source_name":"ThreatFabric_Chameleon_Dec2023","description":"ThreatFabric. (2023, December 21). Android Banking Trojan Chameleon can now bypass any Biometric Authentication. Retrieved July 7, 2025.","url":"https://www.threatfabric.com/blogs/android-banking-trojan-chameleon-is-back-in-action"}]},{"id":"S1231","name":"GodFather","url":"https://attack.mitre.org/software/S1231","kind":"malware","description":"[GodFather](https://attack.mitre.org/software/S1231) has utilized a timer to initiate a WebSocket connection.(Citation: ZimperiumOrtegaPratapagiri_GodFather_Jun2025)   ","relationship_id":"relationship--9f822445-67ed-41b4-ac55-a75940b5b9f6","references":[{"source_name":"ZimperiumOrtegaPratapagiri_GodFather_Jun2025","description":"Ortega, F. Pratapagiri, V. (2025, June 18). Your Mobile App, Their Playground: The Dark Side of Virtualization. Retrieved July 16, 2025.","url":"https://zimperium.com/blog/your-mobile-app-their-playground-the-dark-side-of-the-virtualization"}]}],"actors":[],"mitigations":[],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use owned test devices or emulators, disposable app accounts and test data. Verify platform/version instrumentation; desktop test procedures do not establish mobile coverage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1603":"/ttp-simulation/techniques/mobile/T1603/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"mobile/T1603","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0001","collector":"illustrative-lab-collector","observation":{"task_name":"LabDailyCheck","action":"create","principal":"lab-user","schedule":"daily","program":"lab-check.exe"}}]}}