⚠️ Overview

schtasks is not a standalone malware family but a legitimate Windows utility (schtasks.exe) abused by threat actors for persistence and lateral movement. First documented as an abuse vector in 2016 by MITRE ATT&CK (T1053.005), it falls under the category of living-off-the-land (LOLBin) techniques. Multiple ransomware groups, including REvil and LockBit, have used schtasks to schedule malicious payloads. No single operator exists; rather, the tactic is weaponised by various cybercriminal and nation-state actors.

🔧 Technical Capabilities

The utility creates, deletes, or queries scheduled tasks via command-line switches. Attackers typically use /create with /tn (task name) and /tr (program to run) to achieve persistence, often hiding tasks under legitimate names (e.g., "WindowsUpdate"). Propagation occurs through remote scheduled tasks using /s (remote system) and /u (credentials), leveraging stolen or brute-forced credentials. C2 communication is indirect — schtasks itself does not provide C2; instead the scheduled script or binary (e.g., PowerShell, VBScript) connects outbound. Evasion is achieved via task names mimicking Microsoft processes, high trigger frequencies (e.g., every minute), and use of /ru SYSTEM for privilege escalation. The technique is catalogued under MITRE ATT&CK ID T1053.005 and is often chained with T1547.001 (Registry Run Keys).

📜 History & Notable Incidents

The first widespread abuse of schtasks for persistence was observed in the 2017 NotPetya outbreak, where attackers created tasks to execute the payload at system startup. In 2021, the Kaseya supply-chain ransomware attack (attributed to REvil) used schtasks to deploy encryption binaries across multiple endpoints. The 2022 Industroyer2 campaign (targeting Ukrainian power grids) also employed schtasks for persistence. No specific CVEs apply to the utility itself; however, misuse is referenced in multiple advisories, including CISA AA22-074A (Russian state-sponsored activity). Law enforcement actions have not targeted the tool but rather the groups using it.

🔍 Detection Indicators

Behavioral indicators include schtasks.exe spawning from non-standard parent processes (e.g., wscript.exe, cmd.exe) or creating tasks with /tn names matching common Microsoft task names (e.g., "GoogleUpdateTaskMachineCore"). Network IOCs depend on the payload, but schtasks invocation itself generates Event ID 4698 (Windows Security Log). Registry keys such as HKLMSOFTWAREMicrosoftWindows NTCurrentVersionScheduleTaskCacheTasks reveal hidden tasks. No fixed file hashes exist for the legitimate binary; detection relies on anomaly detection and Sysmon rule ID 1 (process creation).

☠️ Risk & Impact

Impact is severe because schtasks enables persistent, often undetected execution of ransomware, remote access trojans, or data-stealing scripts. Financial losses from ransomware campaigns leveraging schtasks exceeded $1 billion collectively (e.g., LockBit, REvil). Affected sectors include healthcare, energy, government, and manufacturing, as documented in CISA’s Joint Cybersecurity Advisories. Data exfiltration occurs indirectly through scheduled scripts that copy files to remote servers.

🛡️ Mitigation

Mitigation includes restricting schtasks.exe execution via AppLocker or WDAC policies, monitoring Event ID 4698 for suspicious task creation, and applying the Mitre ATT&CK mitigation M1042 (Disable or Remove Feature). Organisations should enforce least-privilege by limiting who can create scheduled tasks, and deploy EDR rules (e.g., Sigma rule id 3c5b9e7a-6c8d-4f1a-9b0e-1f2a3b4c5d6e) to alert on malicious schtasks usage.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.