Search:

Scheduled Task/Job

Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.

The presence of scheduled tasks often happens in scenarios involving persistence (TA0003).

Query

SQL

select distinct t.path, t.user, t.command, t.description, t.author, t.hash , t.parameters 
 from `Machine.scheduledTasksInfo` as t
 where (t.command like '%AppData\Roaming%')

GQL

  scheduledTasks(query: { command: { includes: "AppData\\Roaming" }}) {
    path
    user
    command
    description
    author
    hash
    parameters
  }

MITRE ATT&CK Mapping