T1053.005PersistenceAdvancedDefense plan →

Persistence and Lateral Movement via Scheduled Tasks: Technical Analysis

HARDEC · Savunma Güvenliği Ekibi·Published: June 13, 2026·Updated: July 15, 2026·10 min read

Windows Task Scheduler (schtasks.exe / Schedule.Service COM) is widely used by attackers for both persistence and remote execution (lateral movement). This article covers schtasks syntax, XML task structure, TaskCache registry, EID 4698/4699/4700/4701/4702 + TaskScheduler/Operational 106/140/141/200/201 telemetry, Sigma rules, and hardening controls.

Exploit

Prevention

Detection

Defense profile:2 detection rules 5 mitigations 3 response playbooks

Swipe or use the arrows to move between sections

Section 1 / 3

Zafiyet (Vulnerability)

Tehdit bağlamı, zafiyet ve istismar senaryosu

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Section 2 / 3

Prevention & Hardening

Savunma teknolojileri, policy ve sertleştirme

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Section 3 / 3

Detection

Davranış, loglama ve detection kuralları

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Information note

Detection nuance: For detecting scheduled-task-based persistence and lateral movement, the Microsoft-Windows-TaskScheduler/Operational log should be used as the primary source, as it retains events far longer than the Security log. Remote task creation (schtasks /S) generates RPC traffic and can be monitored at the network level. A common mistake is checking only the task name against the legitimate list of AutoElevate applications rather than the task binary path; the real evidence lies in the TaskPath and Actions fields (MITRE ATT&CK T1053.005).

Detection rules

Directly copyable rules (Sigma/KQL/…) that detect this technique. Each rule specifies its required telemetry, maturity, and source.

Suspicious Scheduled Task Creation (EID 4698 — Temp Directory)

Monitors EID 4698/4702 events in the Windows Security log to detect Scheduled Task creations pointing to user-writable directories such as Temp, AppData, or Public, or to suspicious interpreters (powershell, cmd, mshta). Targets tasks abused for persistence and privilege escalation.

high

sigmaExperimental

Show ruleHide rule

title: Suspicious Scheduled Task Creation via Temp or AppData Path
id: a7c3e8f2-1b4d-4e9a-b0f5-6d2c8a3e7f91
status: experimental
description: |
  Detects scheduled task creation (EID 4698) where the task action references
  temporary or user-writable directories (Temp, AppData, Public, Downloads).
  Adversaries frequently schedule tasks pointing to dropped payloads in these
  locations for persistence or privilege escalation. AI-generated / unvalidated.
references:
  - https://attack.mitre.org/techniques/T1053/005/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_scheduled_task_creation.yml
  - https://www.elastic.co/guide/en/security/current/local-scheduled-task-commands.html
author: CyberSecLab (AI)
date: 2026-06-13
tags:
  - attack.t1053.005
  - attack.persistence
  - attack.privilege_escalation
logsource:
  product: windows
  service: security
detection:
  selection_eid:
    EventID:
      - 4698
      - 4702
  selection_susp_path:
    TaskContent|contains:
      - '\Temp\'
      - '\AppData\'
      - '\Public\'
      - '\Desktop\'
      - '\Downloads\'
      - '\ProgramData\'
      - '\Users\Public\'
  selection_susp_cmd:
    TaskContent|contains:
      - 'powershell'
      - 'cmd.exe'
      - 'regsvr32'
      - 'rundll32'
      - 'certutil'
      - 'bitsadmin'
      - 'mshta'
      - 'wscript'
      - 'cscript'
      - 'wmic'
  condition: selection_eid and (selection_susp_path or selection_susp_cmd)
falsepositives:
  - Legitimate software installers creating tasks with PowerShell actions
  - Enterprise management tools (SCCM, Ansible) deploying tasks pointing to staging paths
  - Developer tooling during application setup
level: high

Not validated

Telemetry required to run: Windows Security Event Logwindows/security (EID 4698 — Scheduled Task Created, EID 4702 — Updated)Windows

False positive: Legitimate software installers, enterprise management tools such as SCCM/Ansible, or developer environments may use similar paths during operation; these processes must be validated against their signature and parent process information.

Source: SIGMA · CC BY-SA 4.0 — AI üretimi, doğrulanmamış

Information note

Informational note: Scheduled tasks launched from temporary directories (%TEMP%, C:\Windows\Temp) (MITRE T1053.005) are high-fidelity indicators. EID 4698 (Security log) records task creation, while EID 106 (Task Scheduler Operational) retains the record for much longer. When both are correlated, the false positive rate drops significantly. The task executor path and command-line arguments must always be examined.

Mitigations

Prevention and hardening measures that mitigate or block this technique.

Audit

Prevention

Advanced audit policy + command-line auditing + Sysmon + directory access auditing: the telemetry that detection requires.

Information note

Informational note: Default Windows audit policies are insufficient; critical events such as failed logons, sensitive privilege use, and object access require additional configuration. Process creation command-line records and network connection logs must be collected with Sysmon. On Linux, auditd default settings are extremely minimal and must be customized for security use cases. Since collection is impossible without log generation, audit policy configuration must be completed before SIEM integration.

Operating System Configuration

Hardening

Bringing the operating system to a secure baseline configuration.

Information note

Informational note: In operating system hardening, SELinux/AppArmor mandatory access controls, removal of unnecessary services, and SSH key-based authentication should be applied together for Linux. Shell history files and configuration files carrying the risk of containing passwords should be audited regularly. For Windows environments, a full audit policy, Sysmon deployment, and secure WinRM configuration constitute the baseline requirements. Passwordless sudo and ANY:ANY sudo policies must be removed for all accounts.

Response playbooks

NIST/SANS phase-based response workflows to follow when this technique is detected.

Techniques in the Persistence tactic

T1546.003PersistenceAdvanced

Windows Management Instrumentation (WMI) event subscription writes the __EventFilter (WQL trigger), __EventConsumer (command/script payload), and __FilterToConsumerBinding triplet persistently into the root\\subscription CIM repository, providing a backdoor that runs with SYSTEM privileges and leaves no traditional autorun trace on disk. For detection, Sysmon EID 19/20/21 and WMI-Activity EID 5861 form the primary signature layer; process tree anomaly and subscription hunting form the behavioral layer.

June 13, 202637 min read

Exploit

Prevention

Detection

References

MITRE ATT&CK — T1053.005: Persistence and Lateral Movement via Scheduled Tasks: Technical Analysis ↗

This article is based on the MITRE ATT&CK framework; the detection, defense, and response content was prepared independently.

Scheduled Task Creation with SYSTEM Privileges via schtasks.exe

Detects task creation/modification operations where schtasks.exe is used with /ru SYSTEM, /rl HIGHEST, or triggers such as ONLOGON/ONSTART from process creation logs (Sysmon EID 1 / EID 4688). This pattern is a classic TTP used by attackers to establish persistence with SYSTEM privileges.

medium

sigmaExperimental

Show ruleHide rule

title: Scheduled Task Creation with SYSTEM Privileges via schtasks.exe
id: 3f8b2d1c-7a4e-4f06-9c8b-1e5d3a2f6b04
status: experimental
description: |
  Detects schtasks.exe invocations that create or modify scheduled tasks to run
  under NT AUTHORITY\SYSTEM or with HIGHEST run level. Attackers use this to
  achieve SYSTEM-level persistence or privilege escalation. Focuses on behavioral
  indicators: /create or /change combined with /ru SYSTEM or /rl HIGHEST.
  AI-generated / unvalidated.
references:
  - https://attack.mitre.org/techniques/T1053/005/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_system.yml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_schedule_type.yml
author: CyberSecLab (AI)
date: 2026-06-13
tags:
  - attack.t1053.005
  - attack.persistence
  - attack.privilege_escalation
logsource:
  product: windows
  category: process_creation
detection:
  selection_image:
    Image|endswith: '\schtasks.exe'
    OriginalFileName: 'schtasks.exe'
  selection_create_or_change:
    CommandLine|contains:
      - '/create'
      - '/change'
      - '-create'
      - '-change'
  selection_system_or_high:
    CommandLine|contains:
      - '/ru NT AUT'
      - '/ru SYSTEM'
      - '/ru "NT AUT'
      - '/rl HIGHEST'
      - ' ONLOGON'
      - ' ONSTART'
      - ' ONIDLE'
  filter_main_windows_update:
    ParentImage|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
    CommandLine|contains:
      - 'WindowsUpdate'
      - 'MicrosoftEdgeUpdate'
      - 'GoogleUpdate'
      - 'TVInstallRestore'
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Windows Update ve kurumsal yazılım güncelleyicileri (Google Update, Edge Update, TeamViewer) zamanlanmış görev oluşturabilir
  - IT yönetim araçları (SCCM, Intune) SYSTEM bağlamında görev oluşturur
level: medium

Not validated

Telemetry required to run: Process Creationwindows/process_creation (Sysmon EID 1 / Security EID 4688)Windows

False positive: Legitimate software such as Windows Update, Google Update, MicrosoftEdgeUpdate, and TeamViewer may create tasks in the SYSTEM context; these processes should be verified by parent process and signature information.

Source: SIGMA · CC BY-SA 4.0 — AI üretimi, doğrulanmamış

Information note

Informational note: The schtasks.exe /ru SYSTEM parameter is commonly used for privilege escalation (MITRE T1053.005). Creating tasks on remote systems also signals lateral movement.

Monitor Task Scheduler Operational and Security logs with cross-correlation.
Generate an immediate alert if the executor path is suspicious for tasks created with SYSTEM privileges.
Add legitimate IT management tools to the baseline allowlist to reduce false positives.

Persistence and Lateral Movement via Scheduled Tasks: Technical Analysis

Zafiyet (Vulnerability)

This section is not open yet

Prevention & Hardening

This section is not open yet

Detection

This section is not open yet

Detection rules

Suspicious Scheduled Task Creation (EID 4698 — Temp Directory)

Mitigations

Audit

Operating System Configuration

Response playbooks

Techniques in the Persistence tactic

References

Scheduled Task Creation with SYSTEM Privileges via schtasks.exe

Privileged Account Management

Restrict File and Directory Permissions

User Account Management

Windows Service and SCM Abuse: Persistence, Privilege Escalation, and Lateral Movement

Linux Attack Detection and DFIR: Persistence, Privilege Escalation, and Log Analysis

Large-Scale DFIR Hunt with Velociraptor (Multi-Endpoint / Active Breach)

Hypothesis-Driven Threat Hunting and Hunt-to-Detection Loop

Scheduled Task Persistence and Lateral Movement Response (T1053.005)