// MITRE ATT&CK
T1053.005 · Scheduled Task
Sub-technique of T1053 · Scheduled Task/Job.
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The [schtasks](https://attack.mitre.org/software/S0111) utility can be run directly on the command line, ...
How to detect & mitigate it
Detecting Scheduled Task starts with your SIEM/EDR telemetry. Write a detection rule with the Sigma generator, analyze suspicious logs in the log analyzer, and place the technique on your coverage with the ATT&CK matrix.
Related techniques
T1047
Windows Management Instrumentation T1129
Shared Modules T1059.007
JavaScript T1053.007
Container Orchestration Job T1559.002
Dynamic Data Exchange T1204.002
Malicious File T1053.003
Cron T1559.001
Component Object Model
Windows Management Instrumentation T1129
Shared Modules T1059.007
JavaScript T1053.007
Container Orchestration Job T1559.002
Dynamic Data Exchange T1204.002
Malicious File T1053.003
Cron T1559.001
Component Object Model
Source: MITRE ATT&CK®. ATT&CK is a registered trademark of The MITRE Corporation. Content for educational purposes.