Tarrask is a Windows persistence technique that hides scheduled tasks by removing metadata so they are harder to see through normal management tools. Attackers use it to stay resident after compromise. Defenders should compare task registry entries, monitor task creation, and hunt for hidden persistence artefacts.
What the Tarrask technique changes in Windows task persistence
Tarrask is dangerous because it does not create an entirely new persistence primitive, it obscures an existing one. By removing task metadata, the scheduled task can remain active while becoming much harder to spot in routine administrative views and many standard cleanup workflows.
The practical effect is stealth. Security teams may still have a live task and an active persistence path, but the normal visibility they rely on, such as GUI task listings or casual review of scheduled task folders, no longer tells the full story.
How hidden scheduled tasks survive normal inspection
Scheduled tasks are often trusted because they are a standard Windows management feature, yet that same trust can be abused for persistence. Tarrask works by separating task execution from the metadata defenders expect to see, so the task may continue to trigger even when the operator cannot easily enumerate it through normal tooling.
That makes the technique especially useful after an initial compromise. An attacker can preserve a foothold without needing to repeatedly drop new malware or re-establish access, which reduces operational noise and increases dwell time.
For defenders, the core lesson is that persistence hunting must look beyond the presentation layer. Registry-backed artefacts, scheduled task definitions, and task-related filesystem traces need to be compared together rather than inspected in isolation.
Detection and exposure checks for Tarrask activity
Exposure is not just whether a scheduled task exists, but whether its metadata can be manipulated or hidden in a way that defeats ordinary review. A system may appear clean in one console while still hosting an active persistence artefact elsewhere in the task infrastructure.
Good investigation practice starts with inventorying scheduled tasks, correlating those tasks with registry entries, and checking for mismatches between what the task scheduler reports and what underlying artefacts show. Review recent task creation and modification activity as well, because hidden persistence often follows a creation event that should have been visible elsewhere.
When a host is suspected, defenders should also review related startup, service, and credentialed execution paths to determine whether Tarrask is one of several persistence mechanisms rather than the only one.
Why persistence hunting matters after compromise
Once a hidden task is in place, the main security problem is not only stealth, but continuity of access. Attackers use persistence to preserve execution after reboots, maintenance, or partial remediation, which means a missed artefact can allow the intrusion to return after the team believes it is contained.
That is why post-incident review should assume the first cleanup pass may be incomplete. If the hidden task controlled commands, launched scripts, or called external infrastructure, the investigation should also trace what the task did before and after it was concealed.
If a compromise is confirmed, MITRE ATT&CK Enterprise Matrix is a useful companion for mapping the persistence pattern to broader adversary behaviour, while NIST SP 800-53 Rev 5 Security and Privacy Controls helps anchor monitoring, audit, and configuration-control expectations around the affected host.
Risk and Threat Considerations
Tarrask is risky because it undermines visibility, which is one of the main controls defenders depend on for persistence detection. A hidden scheduled task can survive routine review, delay containment, and leave an organisation exposed even after obvious indicators of compromise have been removed.
Failure mechanism: The attacker removes or obscures task metadata so the persistence object is no longer easy to enumerate, then relies on the task scheduler to keep executing the hidden job.
Impact: The host can remain resident for longer, remediation can miss the true persistence path, and the attacker may regain execution after reboot or cleanup.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1053 — Scheduled Task/Job | Tarrask is a scheduled-task persistence technique in the ATT&CK enterprise matrix. |
| Recommendation — Map hidden scheduled-task activity to T1053 and hunt for persistence, modification, and concealment indicators. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Hidden task persistence depends on reviewable logs and artefacts to expose mismatches. |
| CM-6 — Configuration Settings | Concealed tasks exploit configuration and management visibility gaps in Windows hosts. | |
| SI-4 — System Monitoring | Detection of hidden scheduled tasks relies on monitoring task creation and persistence artefacts. | |
| Recommendation — Correlate task logs, registry artefacts, and scheduler output under AU-6 to spot concealed persistence. Harden scheduled-task configuration baselines and restrict task modification paths under CM-6. Monitor scheduled-task creation and registry changes under SI-4 to detect stealthy persistence. | ||
Practitioner Guidance
What to watch for: Treat any mismatch between scheduled task registry artefacts, task listings, and filesystem evidence as a meaningful hunting signal. Hidden persistence often shows up first as an inconsistency rather than a direct malicious indicator.
Practitioner takeaway: Do not rely on a single management view to clear a host, because Tarrask is designed to make the obvious answer incomplete.