T1053.005: Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel.CitationStack Overflow In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.CitationRed Canary - Atomic Red Team
An adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence. The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and/or to run a process under the context of a specified account (such as SYSTEM). Similar to System Binary Proxy Execution, adversaries have also abused the Windows Task Scheduler to potentially mask one-time execution under signed/trusted system processes.CitationProofPoint Serpent
Adversaries may also create "hidden" scheduled tasks (i.e. Hide Artifacts) that may not be visible to defender tools and manual queries used to enumerate tasks. Specifically, an adversary may hide a task from `schtasks /query` and the Task Scheduler by deleting the associated Security Descriptor (SD) registry value (where deletion of this value must be completed using SYSTEM permissions).CitationSigmaHQCitationTarrask scheduled task Adversaries may also employ alternate methods to hide tasks, such as altering the metadata (e.g., `Index` value) within associated registry keys.CitationDefending Against Scheduled Task Attacks in Windows Environments
Security context for executives and security teams
Windows Scheduled Tasks matter because they are a normal administration feature that can also provide adversaries with execution, persistence, and privilege-escalation paths. For leaders, the risk is not just that a task exists; it is whether the organization can distinguish approved automation from unauthorized recurring or one-time execution, including tasks hidden from common queries.
Executive priority
Prioritize this technique where Windows endpoints or servers support critical business operations, privileged administration, remote management, or regulated evidence requirements. Executive questions should focus on whether scheduled task creation and execution are audited, whether privileged accounts can create tasks broadly, and whether incident responders can quickly identify suspicious or hidden tasks during containment decisions.
Technical view
For SOC, detection engineering, and IR teams, validate coverage for suspicious scheduled task creation and execution on Windows, aligned to DET0441. Review task creation through schtasks, Task Scheduler GUI, WMI, netapi32, .NET wrappers, and PowerShell Invoke-CimMethod paths where telemetry supports it. Investigate tasks configured for startup, recurring execution, remote execution, or execution as privileged accounts such as SYSTEM. Include checks for hidden-task behavior, especially deletion of the Security Descriptor registry value or suspicious changes to scheduled task registry metadata such as Index values.
Likely telemetry
- Windows Task Scheduler operational and task registration events
- Windows audit events for other object access where configured
- Command-line process creation involving schtasks or PowerShell task creation methods
- WMI/CIM activity related to scheduled task creation
- Registry telemetry for scheduled task keys, including SD value deletion or metadata alteration
Detection direction
- Validate that task creation, modification, execution, and deletion are logged on relevant Windows systems; ATT&CK does not provide official detection text for this object.
- Tune detections around unusual task names, paths, triggers, run-as accounts, remote creation patterns, and tasks launching from nonstandard or user-writable locations, while accounting for legitimate administration and software maintenance.
- Add specific logic for hidden-task indicators, including removal of the SD registry value and suspicious scheduled task registry metadata changes.
- Correlate scheduled task activity with privileged account use, WMI activity, PowerShell Invoke-CimMethod usage, and lateral movement context when available.
- Confirm that common manual queries such as schtasks /query are not the only validation method, because hidden tasks may evade those views.
Mitigation priorities
- Apply user account management and least privilege so ordinary users and unnecessary service accounts cannot create or modify scheduled tasks broadly.
- Strengthen privileged account management for administrators and accounts capable of running tasks as SYSTEM or creating remote scheduled tasks.
- Harden operating system configuration and restrict unnecessary task scheduling pathways where operationally feasible.
- Enable and review auditing for scheduled task activity and related registry changes so detections and compliance evidence have reliable source data.
- Regularly review scheduled tasks on critical Windows systems and compare approved automation against observed task inventory.
Additional notes and limits
This technique is a Windows sub-technique of Scheduled Task/Job and is mapped to execution, persistence, and privilege escalation. Relationship context shows broad historical use by many campaigns and groups, but that should be treated as relevance context rather than proof of current activity in any environment. The supplied mitigation relationships emphasize account management, privileged account management, operating system configuration, and auditing.
Official ATT&CK detection text is not provided for this object. Local conclusions require environment-specific baselines of legitimate scheduled tasks, enabled Windows logging, registry visibility, process command-line collection, and privileged account context. The supplied fields support Windows only for this sub-technique.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel.CitationStack Overflow In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.CitationRed Canary - Atomic Red Team
An adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence. The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and/or to run a process under the context of a specified account (such as SYSTEM). Similar to System Binary Proxy Execution, adversaries have also abused the Windows Task Scheduler to potentially mask one-time execution under signed/trusted system processes.CitationProofPoint Serpent
Adversaries may also create "hidden" scheduled tasks (i.e. Hide Artifacts) that may not be visible to defender tools and manual queries used to enumerate tasks. Specifically, an adversary may hide a task from `schtasks /query` and the Task Scheduler by deleting the associated Security Descriptor (SD) registry value (where deletion of this value must be completed using SYSTEM permissions).CitationSigmaHQCitationTarrask scheduled task Adversaries may also employ alternate methods to hide tasks, such as altering the metadata (e.g., `Index` value) within associated registry keys.CitationDefending Against Scheduled Task Attacks in Windows Environments
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.