schtasks.exe

Overview

schtasks.exe is the command-line interface for Windows Task Scheduler.

It is used to:

Scheduled tasks are used extensively by:

Expected Characteristics

Expected Location

Expected Parents

Common examples include:

Typical Profile

Why This Matters

Scheduled Tasks are one of the most popular persistence mechanisms available on Windows.

Attackers frequently abuse schtasks.exe to:

Unlike many persistence mechanisms, scheduled tasks generate artefacts across multiple operating system components, making them valuable investigative pivots.

Investigation Objective

Determine:

The task definition is usually more important than schtasks.exe itself.

Normal Behaviour

Characteristics

Path

Signature

Parent Processes

Common examples include:

Command Line

Typically:

Typical Activity

Legitimate examples include:

Expected Behavioural Characteristics

Legitimate scheduled tasks generally:

Abuse Patterns

Malicious Task Creation

Investigate tasks created to execute:

powershell.exe

cmd.exe

wscript.exe

cscript.exe

mshta.exe

rundll32.exe

regsvr32.exe

particularly when combined with persistence triggers.

Attackers commonly use schtasks.exe to maintain execution after reboot or user logon.

Suspicious Execution Paths

Investigate task actions referencing:

Particular attention should be paid to newly-created files and low-prevalence binaries. 【1-6d81c5】

Misleading Task Names

Attackers frequently create tasks with names such as:

Task names alone should never be trusted.

Suspicious Trigger Types

Investigate:

Examples include:

These provide reliable persistence opportunities.

SYSTEM-Level Execution

Investigate tasks:

This can indicate privilege escalation or unauthorised persistence.

One-Shot Task Abuse

A common attacker pattern involves:

  1. Create a task
  2. Execute the task
  3. Delete the task immediately afterwards

Examples:

schtasks /create

schtasks /run

schtasks /delete

The task may exist for only a few seconds.

One-shot task abuse is frequently used for:

Hidden or Rare Tasks

Investigate:

Rarity is often a stronger signal than the task name itself.

Suspicious Parent Processes

Investigate schtasks.exe launched by:

These relationships frequently indicate staged execution or phishing activity. 【1-6d81c5】

Detection Opportunities

Process Creation Monitoring

Monitor execution of:

schtasks.exe

particularly command lines containing:

/create

/change

/delete

/run

These actions frequently precede malicious execution.

Scheduled Task Logging

Review:

Useful telemetry sources include:

Task Definition Analysis

Review:

The task definition often reveals attacker intent immediately.

File-System Artefacts

Review:

C:\Windows\System32\Tasks\

for:

Task XML files often contain complete execution details.

Registry Artefacts

Review:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache

Useful locations include:

Changes here may reveal task creation, modification, or deletion activity.

Parent-Child Process Analytics

Investigate relationships such as:

Office
    → schtasks.exe

Browser
    → schtasks.exe

mshta.exe
    → schtasks.exe

These process chains are uncommon during normal business activity.

Command-Line Analytics

Alert on:

The scheduled task frequently acts only as a launcher for a second-stage payload.

Hunting Opportunities

Useful hunting pivots include:

Task rarity often provides stronger hunting signals than task volume.

False Positives

Scheduled tasks are extremely common throughout enterprise environments.

Context is critical.

Common Legitimate Scenarios

Examples include:

Installer Activity

Many installers create tasks for:

Review associated installation activity before escalating.

Validation Questions

Check:

Determine whether the task supports a legitimate business process.

Estate Context

Legitimate tasks often:

Prevalence is often an important validation signal.

Hardening Recommendations

Scheduled Task Governance

Maintain inventories of:

Unknown tasks should be investigated rapidly.

Restrict Task Creation

Limit the ability to:

Reducing task management rights limits persistence opportunities.

Application Control

Consider:

Preventing execution of unauthorised binaries reduces scheduled-task abuse opportunities.

Restrict User-Writeable Execution Paths

Reduce execution opportunities from:

Many malicious tasks rely on user-controlled paths.

Monitor Persistence Mechanisms

Scheduled tasks should be reviewed alongside:

Attackers often establish multiple persistence mechanisms simultaneously.

Review Privileged Tasks

Regularly audit:

These carry greater risk than user-context tasks.

Defensive Validation

Regularly test:

Controls should be validated against realistic attacker workflows.

Triage Checklist

Identity and Integrity

Lineage and Behaviour

Task Definition Review

Identify and review:

Storage Artefact Review

Review:

C:\Windows\System32\Tasks\

and:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache

for supporting evidence.

Scope and Correlation

Escalation Considerations

Escalate immediately when:

ATT&CK References

Windows Processes

Persistence Mechanisms

MITRE ATT&CK