LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Schtasks.exe

View source

Schedule periodic tasks

Execute
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
03DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute2

EXAMPLE 01T1053.005

Create a recurring task to execute every minute.

COMMAND
schtasks /create /sc minute /mo 1 /tn "Reverse shell" /tr "{CMD}"
USE CASE
Create a recurring task to keep reverse shell session(s) alive
PRIVILEGES
User
OPERATING SYSTEM
Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · CMD
EXAMPLE 02T1053.005

Create a scheduled task on a remote computer for persistence/lateral movement

COMMAND
schtasks /create /s targetmachine /tn "MyTask" /tr "{CMD}" /sc daily
USE CASE
Create a remote task to run daily relative to the the time of creation
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · CMD
02 / ON DISK

Known paths

c:\windows\system32\schtasks.exe
c:\windows\syswow64\schtasks.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

3 resources

Indicators & detection notes

  • IOC

    Suspicious task creation events

FURTHER READING

Research & resources