2025 Poland Wiper AttacksC0063 ↗
During the 2025 Poland Wiper Attacks, the adversaries set FortiGate scheduled tasks to run the adversary generated CLI scripts weekly.1
tfMITRE ATT&CK technique
Scheduled Task/Job T1053
- Tactics
- Execution, Persistence, Privilege Escalation
- Platforms
- Containers, ESXi, Linux, macOS, Network Devices, Windows
- Version
- 2.5
- Created
- 31 May 2017
- Last modified
- 12 May 2026
- Contributors
- Prashant Verma, Paladion; Leo Loobeek, @leoloobeek; Travis Smith, Tripwire; Alain Homewood, Insomnia Security; Andrew Northern, @ex_raritas; Bryan Campbell, @bry_campbell; Zachary Abzug, @ZackDoesML; Selena Larson, @selenalarson
Sub-techniques 5126 rules across the family · 19 mapped directly to T1053 · 5 of 5 carry rules
Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.19
Detection rulesTop 15%
Detection rules85th percentile · 85% of ATT&CK techniques have this many detection rules written or fewer.Scheduled Task/Job MITRE reference T1053
72nd pctamong all ATT&CK techniques for number of campaigns
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
All 1 campaigns for this technique
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
LokibotS0447 ↗
Lokibot's second stage DLL has set a timer using “timeSetEvent” to schedule its next execution.1
All 1 software entries for this technique
Offense vs defense T1053
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 12Splunk ESCU (cumulative) · 7
first rule: 2019 Q1 · 1 of 1 campaigns plottedScheduled Task/Job detection strategy DET0094
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Cross-Platform Behavioral Detection of Scheduled Task/Job Abuse
5 platforms
AN0258 · Windows
Detects creation or modification of scheduled tasks using schtasks.exe, at.exe, or COM objects followed by execution of outlier processes tied to the scheduled job.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Scheduled Job CreationDC0001 | WinEventLog:Security | EventCode=4698 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File ModificationDC0061 | WinEventLog:Sysmon | EventCode=2 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TaskAuthor | Unexpected user or account context initiating the task. |
| CommandLineRegex | Suspicious binaries or script usage tied to scheduled tasks. |
| ExecutionWindow | Lookback window to correlate process execution after task registration. |
AN0259 · Linux
Detects creation or modification of cron jobs via crontab, /etc/cron.* directories, or systemd timer units with execution by unusual users or non-standard intervals.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Scheduled Job CreationDC0001 | linux:osquery | crontab, systemd_timers |
| Process CreationDC0032 | auditd:SYSCALL | execve |
| File ModificationDC0061 | auditd:SYSCALL | write, rename |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CronSchedulePattern | Look for high-frequency or off-hour scheduling patterns. |
| ServiceUser | Unusual users scheduling jobs (e.g., www-data, nobody). |
| BinaryEntropy | Abnormal scripts or binaries tied to the scheduled job. |
AN0260 · macOS
Detects creation or alteration of LaunchAgents or LaunchDaemons with corresponding plist modification followed by execution of associated binaries.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Scheduled Job CreationDC0001 | macos:osquery | launchd_jobs |
| Process CreationDC0032 | macos:unifiedlog | process launch |
| File CreationDC0039 | fs:fsusage | disk activity on /Library/LaunchAgents or LaunchDaemons |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PlistLabel | Labels not associated with known applications or vendors. |
| LaunchPath | Executable path outside of standard directories (/usr/bin, /Applications). |
| JobRunInterval | Unexpected periodic job intervals (e.g., every minute). |
AN0261 · Containers
Detects unusual use of cron or sleep loops inside containers executing unfamiliar scripts or binaries repeatedly.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
| File ModificationDC0061 | containerd:runtime | file change monitoring within /etc/cron.*, /tmp, or mounted volumes |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ContainerLabel | Labels or tags indicating dev/test containers executing scheduled tasks. |
| ScriptFrequency | Repetitive invocation pattern within short container lifespan. |
| ImageSource | Unexpected container image sources creating cron entries. |
AN0262 · ESXi
Detects modification of ESXi cron jobs, local.sh scripts, or scheduled API calls to persist custom binaries or shell scripts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Scheduled Job CreationDC0001 | esxi:vmkernel | Startup script and task execution logs |
| File ModificationDC0061 | esxi:cron | manual edits to /etc/rc.local.d/local.sh or cron.d |
| Command ExecutionDC0064 | esxi:hostd | shell access or job registration |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| StartupScriptName | Filename not matching expected initialization scripts. |
| ExecutionContext | Commands run from unexpected SSH sessions or elevated shells. |
| PersistenceInterval | Rare scheduling triggers (e.g., @reboot + hourly repetition). |
AuditM1047
Toolkits like the PowerSploit framework contain PowerUp modules that can be used to explore systems for permission weaknesses in scheduled tasks that could be used to escalate privileges.
Configure settings for scheduled tasks to force tasks to run under the context of the authenticated account instead of allowing them to run as SYSTEM. The associated Registry key is located at HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SubmitControl. The setting can be configured through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > Security Options: Domain Controller: Allow server operators to schedule tasks, set to disabled.
Configure the Increase Scheduling Priority option to only allow the Administrators group the rights to schedule a priority process. This can be can be configured through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Increase scheduling priority.
Restrict access by setting directory and file permissions that are not specific to users or privileged accounts.
Limit privileges of user accounts and remediate Privilege Escalation vectors so only authorized administrators can create scheduled tasks on remote systems.