1200KM / tool
schtasks — Attack Tool
schtasks is used to schedule execution of programs or scripts on a Windows system to run at a specific date and time.
Tool identity and evidence
Included because the active pinned ATT&CK object has type tool. This is an upstream classification, not an assurance of benignness or a recommendation to run it.
Aliases: schtasks, schtasks.exe
Existing author guides
No reviewed association in this snapshot.
Primary documentation
No reviewed association in this snapshot.
Connected ecosystem references
Linked tags
Documented actor use
Explicit actor-to-software uses relationships in the pinned ATT&CK source. These links are historical behavior context, not attribution of current events.
- APT3 · G0022 · Pinned relationship source (relationship--1c812537-dfaf-40da-a71b-a49c18870b77)
- BRONZE BUTLER · G0060 · Pinned relationship source (relationship--d691e305-8ce5-40cd-a648-b0dcab329e69)
- Kimsuky · G0094 · Pinned relationship source (relationship--23206fb2-51fb-4bdb-810d-4f719f7dead8)
Technique-specific simulations and detections
Detection links describe the associated behavior, not independently verified tool-specific signatures.
Telemetry context
Derived from the explicitly linked TTPs; not proof of sensor coverage for this tool.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.