T1053: Scheduled Task/Job
Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.[1]
Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges). Similar to System Binary Proxy Execution, adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.[2]
Analyst context for executives and security teams
Scheduled tasking is normal administration, but it is also a durable way for adversaries to run code now, at startup, or on a recurring schedule across Windows, Linux, macOS, ESXi, containers, network devices, and other supported platforms. The business issue is not simply whether schedulers exist; it is whether the organization can distinguish approved automation from unauthorized execution or persistence under privileged accounts.
Executive priority
Prioritize this as a resilience and assurance control area because scheduled jobs can support execution, persistence, and privilege escalation. Leaders should ask whether privileged scheduling rights are limited, whether scheduled-job changes are audited across server, endpoint, cloud/container, and network environments, and whether incident responders can rapidly inventory and disable suspicious scheduled activity during an investigation.
Technical view
SOC and IR teams should validate coverage for creation, modification, and execution of scheduled tasks/jobs across the parent technique and relevant sub-techniques: Windows Scheduled Task, at, cron, systemd timers, container orchestration jobs, and platform-specific scheduling mechanisms. Pay particular attention to jobs configured for startup or recurring execution, jobs running as elevated or service accounts, remote Windows scheduling activity where authentication and administrative privileges are required, and scheduler-launched processes that may appear to originate from trusted system components. The official ATT&CK object does not provide detection text, but relationship context includes DET0094, Cross-Platform Behavioral Detection of Scheduled Task/Job Abuse.
Likely telemetry
- Scheduled task/job creation, modification, deletion, and execution logs
- Process creation telemetry with command line, parent process, user context, and scheduled execution indicators
- Windows Task Scheduler and remote administration-related activity, including RPC/file and printer sharing context where available
- Linux/macOS job configuration and execution evidence such as cron, at, and systemd timer artifacts
- Container orchestration audit logs for Job or CronJob-style workload creation and changes
Detection direction
- Inventory legitimate scheduled automation first; otherwise backup, patching, monitoring, and administrative jobs will create noisy alerts.
- Alert on new or modified scheduled jobs that execute unusual binaries, scripts, interpreters, writable-path content, or commands inconsistent with the owning account or host role.
- Correlate scheduler changes with privileged logons, remote administration, file writes to job/script locations, and subsequent process execution.
- Review jobs configured for startup, frequent recurrence, or execution under elevated accounts, since the technique maps to execution, persistence, and privilege escalation.
- Validate cross-platform coverage rather than assuming Windows Task Scheduler monitoring covers cron, systemd timers, container orchestration jobs, ESXi, macOS, or network-device scheduling.
Mitigation priorities
- Start with privileged account management: restrict who can create or modify scheduled jobs, especially jobs running as SYSTEM, root, administrator, or service accounts.
- Apply user account management and least privilege so ordinary users and unnecessary groups cannot schedule code on sensitive systems.
- Restrict file and directory permissions on scheduler configuration paths and scripts executed by scheduled jobs.
- Harden operating system and platform configuration by disabling unused scheduling or remote administration paths where operationally feasible.
- Enable and routinely review auditing for scheduled-job configuration and execution, using the results as both detection input and compliance evidence.
Analyst notes and limits
Relationship context maps this technique to mitigation areas M1018, M1022, M1026, M1028, and M1047, and to DET0094 for cross-platform behavioral detection. ATT&CK also lists related use by Lokibot and a Poland wiper campaign, but local risk decisions should be based on the organization’s exposed platforms, privileged account model, and available telemetry.
The supplied ATT&CK object has no official detection narrative, so detection guidance is derived from the technique description, platforms, tactics, sub-technique relationships, and the DET0094 relationship only. This take does not assert active exploitation or existing customer coverage; validation requires local logs, asset inventory, and administrator workflow knowledge.
Scheduled Task/Job
Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.[1]
Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges). Similar to System Binary Proxy Execution, adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.[2]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1053.003 | Cron Sub-technique | Cron subtechnique of this object. |
| Enterprise | T1168 | Local Job Scheduling | Local Job Scheduling revoked by this object. |
| Enterprise | T1053.004 | Launchd Sub-technique | Launchd subtechnique of this object. |
| Enterprise | T1053.005 | Scheduled Task Sub-technique | Scheduled Task subtechnique of this object. |
| Enterprise | T1053.006 | Systemd Timers Sub-technique | Systemd Timers subtechnique of this object. |
| Enterprise | T1053.007 | Container Orchestration Job Sub-technique | Container Orchestration Job subtechnique of this object. |
| Enterprise | T1053.002 | At Sub-technique | At subtechnique of this object. |
Groups, software, and campaigns
S0447: Lokibot
Lokibot is a widely distributed information stealer that was first reported in 2015. It is designed to steal sensitive information such as usernames, passwords, cryptocurrency wallets, and other credentials. Lokibot can also create a backdoor into infected systems to allow an attacker to install additional payloads.[1][2][3]
C0063: 2025 Poland Wiper Attacks
2025 Poland Wiper Attacks is a Russian state-sponsored campaign that conducted destructive cyberattacks against Polish energy infrastructure in December 2025. Targets included more than 30 wind and photovoltaic farms, a combined heat and power (CHP) plant, and a manufacturing sector company. The attacks on the distributed energy resources (DER) disrupted communications between affected facilities and the distribution system operator, but did not impact electricity generation or heat supply. Across the campaign, threat actors deployed two previously undocumented wiper tools, DynoWiper, a Windows-based wiper and LazyWiper, a PowerShell wiper, distributed via malicious Group Policy Objects. At the CHP plant, threat actors had maintained access since at least March 2025, using that foothold to obtain credentials and move laterally before attempting wiper deployment. Some reporting has assessed the activity to be consistent with Russian Federal Security Service (FSB) threat activity group Dragonfly, also tracked as STATIC TUNDRA, while other reporting attributes the destructive wiper activities to the Russian General Staff Main Intelligence Directorate (GRU) threat activity group ELECTRUM, also tracked as Sandworm Team.[1][2][3][4]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 2.5 | Current bundle | 2405a160057c… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
TechNet Task Scheduler Security
Microsoft. (2005, January 21). Task Scheduler and security. Retrieved June 8, 2016.
Open source URL -
[2]
ProofPoint Serpent
Campbell, B. et al. (2022, March 21). Serpent, No Swiping! New Backdoor Targets French Entities with Unique Attack Chain. Retrieved April 11, 2022.
Open source URL -
[3]
mitre-attack T1053Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.