T1053.005 — Scheduled Task

Tactics: Execution, Persistence, Privilege Escalation · Platforms: Windows

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened…

Sub-technique of Scheduled Task/Job (T1053).

Sigma detection rules (1)

T1053.005 Scheduled Task/Job: Scheduled Task

title: "T1053.005 Scheduled Task/Job: Scheduled Task"
id: e2c9c1cf-22a4-475c-ab14-9fb736b24f36
description: 'Detection of Suspicious Scheduled Task Creation and Execution on Windows. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: TimeWindow, UserContext, TaskNamePattern, CommandLineEntropyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1053/005
author: Shahrukh Khan
date: 2026-01-09
license: MIT
tags:
  - attack.execution
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1053.005

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains: '/create'

  filter_common_admin:
    CommandLine|contains:
      - 'GoogleUpdateTaskMachine'
      - 'OneDrive Standalone Update Task'

  condition: selection and not filter_common_admin

falsepositives:
  - Legitimate software installers and IT deployment scripts routinely create scheduled tasks; the filter excludes the most common noisy legitimate tasks, but expect more allowlisting per environment.

level: medium

Related sub-techniques

Explore