taskhost.exe

Overview

taskhost.exe is a generic Windows host process used to execute DLL-based tasks and background components which cannot run independently.

It commonly acts as a container process for scheduled tasks, COM objects, and other Windows components that are implemented as DLLs rather than standalone executables.

Expected Characteristics

Expected Location

Expected Parent

Typically:

Typical Profile

Why This Matters

taskhost.exe is a legitimate Windows binary but frequently appears during investigations because it can execute a wide variety of workloads on behalf of the operating system.

Attackers may abuse scheduled tasks, COM execution, or DLL loading mechanisms to execute malicious code under the context of taskhost.exe.

Because it operates as an execution host, investigators must focus on what taskhost.exe is running rather than simply the presence of taskhost.exe itself.

Relevant ATT&CK Techniques

Investigation Objective

Determine:

Normal Behaviour

Characteristics

Path

Signature

Parent Processes

Common examples include:

Children

Lifetime

Typical Activity

Expected Behavioural Characteristics

taskhost.exe commonly:

Abuse Patterns

Path or Signature Mismatch

Investigate immediately if:

Common masquerading examples include:

taskh0st.exe

taskhost32.exe

taskhosts.exe

Scheduled Task Abuse

Investigate:

Scheduled tasks remain one of the most common persistence mechanisms in enterprise environments.

DLL Path Anomalies

Investigate DLLs loaded from:

Particular attention should be paid to:

Unexpected Child Processes

Investigate children such as:

powershell.exe

cmd.exe

wscript.exe

cscript.exe

mshta.exe

rundll32.exe

Particularly when execution lacks an obvious maintenance or administration context.

Process Injection

Investigate:

taskhost.exe provides a convenient host process for malicious code because it is commonly present on Windows systems.

User-Writable Execution Paths

Investigate tasks executing files from:

Legitimate Windows scheduled tasks rarely execute directly from user-controlled locations.

Detection Opportunities

Scheduled Task Monitoring

Monitor for:

Scheduled task activity often provides more context than process telemetry alone.

Command-Line Analytics

Investigate:

Particularly when associated with Task Scheduler activity.

Parent-Child Process Relationships

Investigate:

Unexpected process lineage frequently provides high-confidence detections.

DLL Monitoring

Investigate:

The DLL often provides the most valuable pivot during investigation.

Persistence Hunting

Useful hunting pivots include:

Correlated Activity

Review:

The strongest detections typically combine scheduled-task activity with additional suspicious indicators.

False Positives

Legitimate taskhost.exe activity is extremely common.

Common Legitimate Scenarios

Windows Maintenance

Examples include:

Enterprise Management Software

Examples include:

Software Updates

Examples include:

These frequently use scheduled tasks for execution.

Validation Questions

Check:

Determine whether the task appears consistently throughout the environment.

Schedule Context

Investigate whether:

Hardening Recommendations

Scheduled Task Governance

Maintain visibility into:

Unexpected changes should generate alerts.

Restrict User-Writable Execution

Reduce execution opportunities from:

This significantly reduces the usefulness of scheduled-task persistence.

Application Control

Consider:

Prevent unauthorised binaries and DLLs from executing through scheduled tasks.

Monitor Persistence Mechanisms

Maintain visibility into:

Persistence mechanisms should be reviewed collectively rather than in isolation.

Review Legacy Tasks

Regularly review:

Many environments accumulate scheduled tasks over time that are no longer required.

Defensive Validation

Regularly test:

Validation should focus on realistic persistence techniques rather than simple task creation events.

Triage Checklist

Identity and Integrity

Scheduled Task Context

Process and DLL Review

Scope and Context

Escalation Considerations

Escalate when:

ATT&CK References

Windows Processes

Windows Scheduling

MITRE ATT&CK