tool

schtasks S0111

Type: tool
Platform: Windows
Created: 31 May 2017
Last modified: 16 April 2025

schtasks is used to schedule execution of programs or scripts on a Windows system to run at a specific date and time. [1]

TechniqueBottom 5%

TacticsBottom 21%

Threat groupsunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

schtasks MITRE reference S0111

Scheduled Task T1053.005 ↗

schtasks is used to schedule tasks on a Windows system to run at a specific date and time.2

Execution · Persistence · Privilege Escalation79 detection rules

Standing S0111

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Technique1Bottom 5%

5th percentile · 95% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics3Bottom 21%

21st percentile · 79% of 825 ATT&CK software entries have more tactics spanned.

Threat groups361% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique79medTop 1%

99th percentile · 99% of 825 ATT&CK software entries have this many detection rules per technique or fewer.

Tests / technique14medTop 2%

98th percentile · 98% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.

Data comps / technique5med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique4medTop 1%

99th percentile · 99% of 825 ATT&CK software entries have this many mitigations per technique or fewer.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this tool’s 1 Enterprise technique.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 54Splunk ESCU (cumulative) · 25

Standing S0111

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects execution of ChromeLoader malware via a registered scheduled task	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task Persistence Software Extensions	-	high	@kostastsale	2022-01-10	—	0a74c5a9-1b71-4475-9af2-7829d320d5c2
	Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot AP (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	medium	Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1)	2019-03-04	2022-10-09	958d81aa-8566-4cea-a565-59ccd4df27b0
	Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during (...)	Emerging	test	scheduled_job	windows	WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	CVE-2023-42793	critical	Nasreddine Bencherchali (Nextron Systems)	2023-10-24	—	3b8e5084-4de9-449a-a40d-0e11014f2e2d
	Detects the creation of a schtask via PowerSploit or Empire Default Configuration.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Markus Neis, @Karneades	2018-03-06	2023-03-03	56c217c3-2de2-479b-990f-5c109ba8458f
	Detects when adversaries stop services or processes by deleting or disabling their respective schedu (...)	Generic	test	scheduled_job	windows	WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-12-05	2023-03-13	7595ba94-cf3b-4471-aa03-4f6baa9e5fad
	Detects Kapeka backdoor persistence activity. (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Swachchhanda Shrawan Poudel	2024-07-03	—	64a871dd-83f6-4e5f-80fc-5a7ca3a8a819
	Detects Kapeka backdoor scheduled task creation based on attributes such as paths, commands line flags, etc.	Emerging	test	scheduled_job	windows	WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Swachchhanda Shrawan Poudel	2024-07-03	—	6c130acd-0adb-4545-bcc4-2e85d0883c9a
	Detects OilRig activity as reported by Nyotron in their March 2018 report	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Application Layer Protocol DNS Persistence, Privilege Escalation Create or Modify System Process Windows Service Persistence, Defense Impairment Modify Registry Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	critical	Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community	2018-03-23	2023-03-08	ce6e34ca-966d-41c9-8d93-5b06c8b97a06
	Detects OilRig registry persistence as reported by Nyotron in their March 2018 report	Emerging	test	registry_event	windows	Sysmon · WinEventLog Security	Command and Control Application Layer Protocol DNS Persistence, Privilege Escalation Create or Modify System Process Windows Service Persistence, Defense Impairment Modify Registry Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	critical	Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community	2018-03-23	2023-03-08	7bdf2a7c-3acc-4091-9581-0a77dad1c5b5
	Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report	Emerging	test	scheduled_job	windows	WinEventLog Security	Command and Control Application Layer Protocol DNS Persistence, Privilege Escalation Create or Modify System Process Windows Service Persistence, Defense Impairment Modify Registry Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	critical	Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community	2018-03-23	2023-03-08	c0580559-a6bd-4ef6-b9b7-83703d98b561
	Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report	Emerging	test	service	windows	WinEventLog System	Command and Control Application Layer Protocol DNS Persistence, Privilege Escalation Create or Modify System Process Windows Service Persistence, Defense Impairment Modify Registry Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	critical	Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community	2018-03-23	2023-03-08	53ba33fd-3a50-4468-a5ef-c583635cfa92
	Detects activity mentioned in Operation Wocao report	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Masquerading Masquerade Task or Service Stealth Obfuscated Files or Information Discovery Query Registry Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Florian Roth (Nextron Systems), frack113	2019-12-20	2022-10-09	1cfac73c-be78-4f9a-9b08-5bde0c3953ab
	Detects activity mentioned in Operation Wocao report	Emerging	test	account_management	windows	WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Masquerading Masquerade Task or Service Stealth Obfuscated Files or Information Discovery Query Registry Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Florian Roth (Nextron Systems), frack113	2019-12-20	2022-11-27	74ad4314-482e-4c3e-b237-3f7ed3b9ca8d
	Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale	Generic	test	account_management	windows	WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Samir Bousseaden	2019-04-03	2024-09-04	a8f29a7b-b137-4446-80a0-b804272f3da2
Splunk	The following analytic detects the spawning of a PowerShell process as a child or grandchild of commonly abused processes like services.exe, wmiprvse.exe, svchost.exe, wsmprovhost.exe, and mmc.exe. (...)	Anomaly	stable	process_creation	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services Distributed Component Object Model Windows Remote Management Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task Stealth System Binary Proxy Execution MMC Execution Windows Management Instrumentation	-	medium	Mauricio Velazco, Michael Haag, Splunk	2021-11-29	2026-10-09	cb909b3e-512b-11ec-aa31-3e22fbd008af
	Detects specific process parameters as used by ACTINIUM scheduled task persistence creation.	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Andreas Hunkeler (@Karneades)	2022-02-07	2023-03-18	e1118a8f-82f5-44b3-bb6b-8a284e5df602
	Detects potential exploitation of the BearLPE exploit using Task Scheduler ".job" import arbitrary D (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Olaf Hartong	2019-05-22	2023-01-26	931b6802-d6a6-4267-9ffa-526f57f22aaf
	Detects manual execution of the "Microsoft Compatibility Appraiser" task via schtasks. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	medium	Sreeman	2020-09-29	2023-02-10	f548a603-c9f2-4c89-b511-b089f7e94549
	Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	pH-T (Nextron Systems), Florian Roth (Nextron Systems)	2022-04-08	2023-02-03	b66474aa-bd92-4333-a16c-298155b120df
	Detects potential persistence behavior using the windows telemetry registry key. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Lednyov Alexey, oscd.community, Sreeman	2020-10-16	2023-08-17	73a883d0-0348-4be4-a8d8-51031c2564f8
	Detects the creation of new scheduled tasks via commandline, using Schtasks.exe. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Rory Duncan	2025-07-14	—	2daa93a0-a5fb-41c5-8cd8-3c11294bfd1f
	Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring (...)	Generic	test	ps_script	windows	PowerShell	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	medium	frack113	2021-12-28	2025-10-07	363eccc0-279a-4ccf-a3ab-24c2e63b11fb
Splunk	The following analytic detects the creation of a Scheduled Task with a high entropy, randomly generated name, leveraging Event ID 4698. (...)	Hunting	experimental	scheduled_job	windows	WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	medium	Mauricio Velazco, Splunk	2021-11-30	2026-05-13	9d22a780-5165-11ec-ad4f-3e22fbd008af
	This rule detects rare scheduled task creations. (...)	Unsupported	unsupported	scheduled_job	windows	Task Scheduler	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	low	Florian Roth (Nextron Systems)	2017-03-17	2023-02-24	b20f6158-9438-41be-83da-a5a16ac90c2b	-
	Detects rare scheduled tasks creations that only appear a few times per time frame and could reveal (...)	Unsupported	unsupported	scheduled_job	windows	WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	low	Florian Roth (Nextron Systems)	2017-03-23	2023-02-24	b0d77106-7bb0-41fe-bd94-d1752164d066	-
	Detects remote execution via scheduled task creation or update on the destination host	Unsupported	unsupported	authentication	windows	WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	medium	Jai Minton, oscd.community	2020-10-05	—	cf349c4b-99af-40fa-a051-823aa2307a84
	Detects the execution of renamed schtasks.exe binary, which is a legitimate Windows utility used for scheduling tasks. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Rename Legitimate Utilities Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-11-27	2026-10-02	f91e51c9-f344-4b32-969b-0b6f6b8537d4
	Detects Schtask creations that point to a suspicious folder or an environment variable often used by (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	medium	Florian Roth (Nextron Systems)	2022-02-21	2025-10-07	81325ce1-be01-4250-944f-b4789644556f
	Detects the creation of a scheduled task via file creation.	Hunting	test	file_event	windows	Sysmon	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	low	Center for Threat Informed Defense (CTID) Summiting the Pyramid Team	2023-09-27	—	a762e74f-4dce-477c-b023-4ed81df600f9
	Detects the creation of a scheduled task via Registry keys.	Hunting	test	registry_event	windows	Sysmon · WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	low	Center for Threat Informed Defense (CTID) Summiting the Pyramid Team	2023-09-27	—	93ff0ceb-e0ef-4586-8cd8-a6c277d738e3
	Detects the execution of "schtasks.exe" from a parent that is located in a potentially suspicious location. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	medium	Florian Roth (Nextron Systems)	2022-02-23	2024-05-13	9494479d-d994-40bf-a8b1-eea890237021
	Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence.	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Masquerade Task or Service Match Legitimate Resource Name or Location Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-02-05	—	9f8573c9-22b4-40e3-89c1-72bc2b8d49ab
	Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	low	Florian Roth (Nextron Systems)	2019-01-16	2025-10-22	92626ddd-662c-49e3-ac59-f6535f12d189
	Detects the creation of a scheduled task using schtasks.exe, potentially in combination with curl for downloading payloads and PowerShell for executing them. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task Stealth System Binary Proxy Execution	-	medium	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-02-05	—	1d174d38-8fda-4081-a9b6-56d9763c0cd8
Splunk	The following analytic detects the creation or deletion of scheduled tasks via schtasks.exe when invoked with create or delete flags, specifically focusing on those executions where the process includes additional parameters such as /tr, /sc, or /ru. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-10-09	d5af132c-7c17-439c-9d31-13d55340f36c
	Detects scheduled task deletion events. (...)	Hunting	test	scheduled_job	windows	WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	low	David Strassegger, Tim Shelton	2021-01-22	2023-01-20	4f86b304-3e02-40e3-aa5d-e88a167c9617
	Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious loca (...)	Generic	test	scheduled_job	windows	Task Scheduler	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-12-05	2023-02-07	424273ea-7cf8-43a6-b712-375f925e481f
	Detects the execution of Scheduled Tasks where the program being run is located in a suspicious loca (...)	Generic	test	scheduled_job	windows	Task Scheduler	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-12-05	2023-02-07	f0767f15-0fb3-44b9-851e-e8d9a6d0005d
	Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	pH-T (Nextron Systems), @Kostastsale, TheDFIRReport, X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2022-02-12	2023-02-04	c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78
	Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	medium	X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2023-07-18	—	86588b36-c6d3-465f-9cee-8f9093e07798
Splunk	The following analytic detects the use of 'schtasks.exe' to start a Scheduled Task on a remote endpoint. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	medium	Mauricio Velazco, Splunk, Badoodish, Github Community	2021-11-11	2026-10-02	95cf4608-4302-11ec-8194-3e22fbd008af
	Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a pro (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Syed Hasan (@syedhasan009)	2021-06-18	2025-10-22	4720b7df-40c3-48fd-bbdf-fd4b3c464f0d
	Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-07-28	2025-02-15	89ca78fd-b37c-4310-b3d3-81a023f83936
	Detects scheduled task creations that have suspicious action command and folder combinations	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Florian Roth (Nextron Systems)	2022-04-15	2022-11-18	8a8379b8-780b-4dbf-b1e9-31c8d112fefb
Splunk	The following analytic detects the use of 'schtasks.exe' to create a scheduled task on a remote system, indicating potential lateral movement or remote code execution. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	medium	David Dorsey, Mauricio Velazco, Splunk	2019-10-16	2026-10-02	1297fb80-f42a-4b4a-9c8a-88c066237cf6
Splunk	The following analytic detects the use of 'schtasks.exe' to schedule forced system reboots using the 'shutdown' and '/create' flags. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-05-13	1297fb80-f42a-4b4a-9c8a-88c066437cf6	-
	Detects post exploitation execution technique of the Serpent backdoor. (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Python Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	@kostastsale	2022-03-21	—	d5eb7432-fda4-4bba-a37f-ffa74d9ed639
Splunk	The following analytic detects the creation and deletion of scheduled tasks within a short time frame (less than 30 seconds) using Windows Security EventCodes 4698 and 4699. (...)	Anomaly	stable	scheduled_job	windows	WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	medium	Mauricio Velazco, Splunk	2021-12-03	2026-07-07	6fa31414-546e-11ec-adfa-acde48001122
	Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon com (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Florian Roth (Nextron Systems)	2022-02-23	2024-03-19	f2c64357-b1d2-41b7-849f-34d2682c0fad
	Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspiciou (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-07-28	2022-11-18	1c0e41cd-21bb-4433-9acc-4a2cd6367b9b