thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Scheduled Task

A Windows mechanism for running programs at specified times or events, frequently abused for persistence and execution.

Definition

Attackers create tasks with schtasks.exe, PowerShell or the Task Scheduler API to run payloads at logon, at intervals or with SYSTEM privileges (ATT&CK T1053.005). Task creation is logged in Security Event ID 4698 and task XML files reside in C:\Windows\System32\Tasks. Linux equivalents are cron and systemd timers.

Example

schtasks /create /tn "OneDrive Sync" /tr C:\ProgramData\x.exe /sc onlogon /ru SYSTEM

Exam tip

Event ID 4698 = scheduled task created.

Related terms