High severityNIST SP 800-6139 steps · 6 phases

Scheduled Task Persistence and Lateral Movement Response (T1053.005)

Covers detection, containment, task and artifact cleanup, and hardening steps for incidents where an attacker establishes persistence or executes remote tasks (lateral movement) via Windows Task Scheduler.

Updated: June 13, 2026

Information note

Informational note: Under MITRE ATT&CK T1053.005, scheduled task persistence should be monitored via task creation and execution events in the Microsoft-Windows-TaskScheduler/Operational log; this log retains data longer than the Security log. For suspicious tasks, the execution path, trigger type, and running account should be examined; task binaries not present on the system should be treated as evidence of lateral movement.

Prepare

6 steps

Verify audit policy
`auditpol /get /subcategory:"Other Object Access Events"` output must show "Success" enabled; if not, enable it via GPO (mandatory for EID 4698–4702)
Enable TaskScheduler/Operational log
Add `wevtutil sl Microsoft-Windows-TaskScheduler/Operational /e:true` to the GPO startup script; it is disabled by default on Windows 10/11
Verify Sysmon ProcessCreate and FileCreate rules
Check Sysmon config to confirm that Sysmon EID 1 (process creation) and EID 11 (FileCreate under `%SystemRoot%\System32\Tasks`) rules are active
Capture task catalog baseline
Save the known-good state with `Get-ScheduledTask | Select-Object TaskName,TaskPath,State | Export-Csv "$env:SystemDrive\task_baseline.csv" -NoTypeInformation`
Verify LAPS deployment
Confirm that local administrator passwords are unique domain-wide via LAPS UI or AD attribute query; if not, deploy as P0
Define decision matrix
If ≥ 3 hosts are affected, trigger enterprise IR and notify CISO/Legal; if a Domain Admin account is involved, Kerberos ticket cleanup is mandatory during Eradication

Scheduled Task Persistence and Lateral Movement Response (T1053.005)

Prepare

Detect & Analyze

Contain

Eradicate

Recover

Post-Incident