Log in Request a demo

Attack technique

Scheduled Task/Job

Scheduled Task/Job is a technique where an attacker uses the task scheduling feature built into an operating system.

In short

Scheduled Task/Job is a technique where an attacker uses the task scheduling feature built into an operating system. The feature runs a program or script at a set time or on a repeat. Attackers use it to start malicious code, to keep their access after a restart, or to run code with higher privileges.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact
  1. MITRE IDT1053ATT&CK technique
  2. Detection4ways to spot itWatch for new or changed tasks · Look for hidden or odd tasks
  3. Defences4ways to stop itLimit who can schedule tasks

How it works

All major operating systems include tools that run programs or scripts at a chosen date and time. Attackers abuse these tools to start malicious code once or to run it again and again.

A scheduled task can run at system startup or on a fixed schedule, which helps an attacker keep access. It can also run under a chosen account, including one with higher privileges. A task can also be set up on another system, but this usually requires membership in an admin or otherwise privileged group there.

Because the scheduler is a trusted system component, a one-time run can look like normal system activity. On Windows, the Scheduled Task sub-technique (T1053.005) also covers hidden tasks that may not show up in the tools defenders use to list tasks. MITRE lists five sub-techniques: T1053.002 At, T1053.003 Cron, T1053.005 Scheduled Task, T1053.006 Systemd Timers and T1053.007 Container Orchestration Job.

A real example

  • MITRE ATT&CK lists Lokibot as having a second stage DLL that sets a timer to schedule its next run.
  • MITRE ATT&CK lists a campaign MITRE names 2025 Poland Wiper Attacks as setting scheduled tasks on a network security device to run attacker-made command line scripts every week.

How to detect

  1. Watch for new or changed tasks

    Log the creation, change and deletion of scheduled tasks, whether made through the scheduler, management interfaces or scripts.

  2. Link the task to what runs next

    Look for a task change followed by an unusual process starting from it, especially a task created under a SYSTEM or otherwise suspicious account.

  3. Look for hidden or odd tasks

    Compare the tasks you can list with expected ones. Tasks that are hidden, or that run at unusual intervals or as unusual users, deserve a closer look.

  4. Data sources MITRE lists

    Command Execution, File Creation, File Modification, Process Creation, Scheduled Job Creation

How to defend

  1. Limit who can schedule tasks

    Let only authorized administrators create scheduled tasks on remote systems, and remove paths that let ordinary accounts gain more privileges.

  2. Run tasks as the signed-in account

    Configure scheduling settings so tasks run under the authenticated account instead of SYSTEM, and let only the Administrators group raise scheduling priority.

  3. Restrict file and directory permissions

    Set permissions that are not open to every user, so that tasks and the files they run cannot easily be altered.

  4. Audit for permission weaknesses

    Check systems for weak permissions on scheduled tasks that could be used to gain higher privileges.

Questions

What is Scheduled Task/Job (T1053)?

Scheduled Task/Job is a technique where an attacker uses the task scheduling feature built into an operating system. The feature runs a program or script at a set time or on a repeat, and attackers use it to run malicious code, keep access after a restart or gain higher privileges.

Why do attackers abuse task scheduling?

All major operating systems include tools that run programs at a chosen time. A task can run at startup or on a schedule, which helps an attacker keep access, and it can run under a chosen account, including a privileged one. Because the scheduler is trusted, activity can look normal.

How can defenders detect malicious scheduled tasks?

Log the creation, change and deletion of scheduled tasks, however they were made. Look for a task change followed by an unusual process starting from it, especially a task created under a SYSTEM or otherwise suspicious account. Compare listed tasks with expected ones to find hidden or odd tasks.

How do I defend against Scheduled Task/Job abuse?

Let only authorized administrators create scheduled tasks on remote systems, and set tasks to run under the signed-in account instead of SYSTEM. Use restrictive file and directory permissions, and audit systems for weak permissions on scheduled tasks that could give higher privileges.

In our research

  1. NetScaler exposed edge: questions to ask your team October 2026
  2. GRU targeting of logistics firms: advisory AA25-141A October 2026
  3. Agentic Ransomware: What Happens When Malware Doesn’t Need a Human Operator to Decide Who to Hit Next? September 2026
  4. WIRTE: Covert Espionage Actor Targeting the Middle East and Beyond July 2026
  5. WIRTE: Iran’s Covert Espionage Actor Targeting the Middle East and Beyond April 2026
  6. UAC-0194: Inside a Rapidly Evolving NTLM-Exploiting Espionage Operation April 2026

Sources

  1. MITRE ATT&CK T1053: Scheduled Task/Job MITRE
  2. MITRE ATT&CK T1053.005: Scheduled Task/Job: Scheduled Task MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Persistence

Persistence is the set of actions an attacker takes to keep access to a system after the first break-in.

Read more

Glossary term

Privilege escalation

Privilege escalation is when an attacker gains higher-level permissions than they started with.

Read more