Every operating system and orchestrator ships a scheduler that runs code on a timer under a chosen account, and intruders use it for persistence, privilege and remote execution because a new scheduled job looks exactly like routine administration. MITRE ATT&CK T1053 Scheduled Task/Job covers Windows Task Scheduler, at, cron, systemd timers and Kubernetes CronJobs, and in ATT&CK v20 it spans three tactics: Execution (TA0002), Persistence (TA0003) and Privilege Escalation (TA0004). This guide goes beyond our general persistence page: it sets out the telemetry each scheduler produces, the audit settings that switch it on, how to baseline the thousands of legitimate jobs in an estate, and how scheduled jobs that run as service accounts become a non-human identity risk. It is for detection engineers, platform owners and incident responders; it contains no attack procedures.
Key takeaways
- Turn on the right audit subcategory. Windows logs scheduled task creation (4698), deletion (4699), enabling (4700), disabling (4701) and update (4702) only when Audit Other Object Access Events is enabled.
- The task XML is the evidence. Event 4698 carries the full task definition, including the action, the principal and the logon type, so detections can inspect what will run and as whom.
- Stored passwords are an NHI problem. Microsoft advises alerting when a task uses
<LogonType>Password</LogonType>, because the account's password is stored and can be extracted with administrative rights. - Linux needs file and process audit. Cron and systemd timers have no single "job created" event; detection relies on watching
/etc/cron*,/var/spool/cronand systemd unit directories plus process lineage fromcronand PID 1. - In clusters, the API server audit log is the source of truth. A
createoncronjobsin thebatchgroup by an unexpected identity is the Kubernetes equivalent of event 4698.
How the attack works
ATT&CK describes T1053 as abuse of task scheduling "to facilitate initial or recurring execution of malicious code". Jobs can run at start-up or on a schedule for persistence, can be created on a remote system when the intruder holds administrative rights there, and can run under a specified account such as SYSTEM, which is the privilege escalation angle. ATT&CK also notes that schedulers are used to mask one-time execution under a trusted system process, similar to T1218 System Binary Proxy Execution.
| Sub-technique (v20) | Platform | Mechanism | Primary telemetry |
|---|---|---|---|
| T1053.005 Scheduled Task | Windows | Task Scheduler through schtasks, the GUI, COM, .NET wrappers or WMI (PS_ScheduledTask) | Security 4698 to 4702; Sysmon 1, 11, 13 and 14; tasks run under svchost.exe or taskeng.exe |
| T1053.002 At | Windows, Linux, macOS | The legacy at utility; deprecated on Windows in favour of schtasks | 4698 and process creation on Windows; execve and writes under /var/spool/cron/atjobs on Linux |
| T1053.003 Cron | Linux, macOS, ESXi | Crontab entries; on ESXi written directly to /var/spool/cron/crontabs/root | auditd write and rename on cron paths; execve by cron children |
| T1053.006 Systemd Timers | Linux | .timer units paired with a .service of the same name; can be activated remotely with systemctl over SSH | File events on /etc/systemd/system and /usr/lib/systemd/system; systemctl and systemd-run execution |
| T1053.007 Container Orchestration Job | Containers | Kubernetes CronJobs that schedule Jobs running containers across nodes | API server audit: verb=create, resource=cronjobs, group=batch |
Two stealth variants matter for detection. ATT&CK records "hidden" Windows tasks created by deleting the task's Security Descriptor (SD) registry value, which needs SYSTEM rights and hides the task from schtasks /query and the Task Scheduler console, and tasks hidden by altering registry metadata such as the Index value. Both leave registry traces that Sysmon 12 to 14 can capture.
Where it shows up
- Commodity malware and ransomware: ATT&CK links T1053 to a very large set of groups and software, including APT29, FIN7, Lazarus Group, Sandworm Team and Wizard Spider. Ransomware operators commonly push the encryptor as a scheduled task to many hosts at once.
- Lateral movement: remote task creation over RPC with administrative credentials, an alternative to service-based remote execution. See the Lateral Movement Guide.
- Linux servers and cloud instances: cron entries that re-download a miner or backdoor every few minutes are a staple of cryptojacking campaigns.
- Hypervisors: ATT&CK's ESXi analytics watch crontab and
/etc/rc.local.d/local.shedits. See the ESXi Logs Detection Guide. - Kubernetes: a CronJob gives recurring execution on cluster nodes that survives pod deletion. See the Kubernetes Security Guide.
- Automation platforms: CI schedules, cloud schedulers and workflow tools are not T1053 sub-techniques (the v20 platforms do not include IaaS or SaaS), but they are the same pattern: a timer plus an identity. Govern them the same way.
Impact
- Persistence that survives reboot and remediation: a job can reinstall a removed implant on its next run.
- Privilege escalation: a task or timer configured to run as SYSTEM or root executes the intruder's code at that level.
- Credential exposure: tasks that store an account password, and cron scripts with embedded secrets, hand credentials to anyone with administrative access to the host.
- Mass deployment: a scheduled job pushed through Group Policy, a management tool or a DaemonSet-style CronJob reaches every host quickly.
- Blending in: estates contain thousands of legitimate jobs, so a single new one with a plausible name is easy to miss without a baseline.
Detection
| Platform | Source | What to alert on |
|---|---|---|
| Windows | Security 4698 (Audit Other Object Access Events). On Windows 10 1903 and later the event adds ClientProcessId, ParentProcessId and RpcCallClientLocality | New tasks in the library root (\TaskName), tasks whose action runs from user-writable paths, script hosts or encoded PowerShell, tasks running as SYSTEM created by non-admin tooling, and remote creation |
| Windows | Security 4702 (task updated) and 4699 (deleted) | Changes to existing tasks, especially Microsoft-named tasks whose action changes; delete shortly after first run (one-shot execution) |
| Windows | Sysmon 11 and 13 on C:\Windows\System32\Tasks and the Schedule\TaskCache registry tree | Task files or registry entries with no matching 4698 event, and deletion of the SD value (hidden task) |
| Windows | Sysmon 1 or EDR process lineage | Unusual children of the Task Scheduler service host, such as rundll32, mshta or scripting engines running from temporary paths |
| Linux | auditd watches on /etc/crontab, /etc/cron.d, /etc/cron.*, /var/spool/cron | Writes by anything other than package managers or configuration management; crontab edits by web server or application accounts |
| Linux | auditd on /etc/systemd/system and /usr/lib/systemd/system; execve of systemctl and systemd-run | New .timer units outside deployments, transient timers, timers with Persistent=true pointing at unknown binaries |
| Linux and containers | Process lineage from cron and PID 1; osquery crontab and systemd_timers tables | Scheduled processes running curl or wget piped to a shell, or binaries from /tmp and /dev/shm |
| Kubernetes | API server audit log | CronJob create or patch by identities that do not normally deploy, images from unapproved registries, CronJobs in kube-system created outside GitOps |
Baselining legitimate jobs
- Collect inventory: export tasks, crontabs, timers and CronJobs from every host and cluster, with action, principal and creator.
- Classify: operating system jobs, vendor agents, your own automation, and unknown. Assign owners to the last two.
- Allowlist by attributes: path, signer, principal and creator, not task name alone, since names are easy to imitate (T1036.004 Masquerade Task or Service).
- Alert on drift: any new job not created by approved deployment tooling raises an alert; daily inventory diffs catch jobs created while logging was off.
Metrics
- Audit coverage: percentage of Windows hosts with Audit Other Object Access Events (Success) and of Linux hosts with cron and systemd audit rules.
- Unknown jobs: count of scheduled jobs without an owner, trending to zero.
- Stored credentials: number of tasks with
LogonTypePassword and cron scripts containing secrets. - Drift alerts: new jobs per week outside change windows, and the share confirmed as legitimate.
- Cluster control: percentage of CronJobs created through GitOps rather than direct API calls.
Prevention and hardening
ATT&CK maps five mitigations to T1053: M1018 User Account Management, M1022 Restrict File and Directory Permissions, M1026 Privileged Account Management, M1028 Operating System Configuration and M1047 Audit.
| Platform | Control | Notes |
|---|---|---|
| Windows | Enable Audit Other Object Access Events; Microsoft recommends Success and Failure on domain controllers, member servers and workstations | Start with Success for the scheduled task events. See the Windows Event Log Guide. |
| Windows | Limit who is a local administrator, since remote task creation needs administrative rights on the target | LAPS for local admin passwords, tiered admin accounts |
| Windows | Run tasks as gMSAs or built-in service identities rather than stored user passwords | Removes the stored password Microsoft warns about |
| Linux | Use /etc/cron.allow to restrict which users may create crontabs; root-owned, non-writable cron directories | M1022 in practice; review at.allow likewise or remove at |
| Linux | Manage unit files and timers only through configuration management; file integrity monitoring on unit directories | See the systemd Service Hardening Guide. |
| Kubernetes | RBAC that grants create on cronjobs only to deployment identities; admission policy for image source and security context | See the Kubernetes Admission Control Guide. |
| All | Remove secrets from job definitions and scripts; fetch them at run time from a vault | See the Secrets Rotation Runbook Template. |
Rollout
- Enable telemetry on a pilot group: the Windows audit subcategory, auditd rules for cron and systemd paths, Kubernetes audit for the
batchgroup. Measure event volume for a week. - Inventory and baseline as above, and fix the worst exposures first: tasks with stored passwords and cron scripts with secrets.
- Detect in alert-only mode for two to four weeks to tune allowlists, then route confirmed rules to the SOC.
- Restrict creation:
cron.allow, RBAC changes and local admin reduction by ring, with the owner of each affected job told in advance. - Roll back by restoring the previous allow file or RBAC binding from configuration management; audit settings can stay on even if restrictions are reverted.
Small and large estates
A small team gets most of the value from turning on the audit subcategory, alerting on new root-level tasks and cron writes, and fixing stored passwords. A large estate needs automated daily inventory diffs, owner records for every non-system job, GitOps-only CronJobs and correlation of task creation with the logon that created it, so remote creation by an unusual account raises severity.
Where identity fits
Every scheduled job runs as an identity, and many run as service accounts with stored passwords, long-lived keys in scripts or cluster service accounts with broad RBAC. Inventory those identities alongside the jobs, replace stored passwords with gMSAs or workload identity, scope each to the job's needs, and rotate the credentials of any job created or modified by an intruder. See the Service Account Security Guide and the Kubernetes Service Account Token Guide.
Framework mapping
| Framework | Relevant items |
|---|---|
| MITRE ATT&CK v20 | TA0002, TA0003, TA0004; T1053.002, .003, .005, .006, .007; related T1036.004, T1564 Hide Artifacts, T1218 |
| MITRE D3FEND | D3-SJA Scheduled Job Analysis, D3-FIM File Integrity Monitoring, D3-PA Process Analysis |
| NIST SP 800-53 Rev. 5 | AU-12 Audit Record Generation, SI-4 System Monitoring, CM-3 Configuration Change Control, CM-7 Least Functionality, AC-6 Least Privilege |
| NIST CSF 2.0 | PR.PS-01 (configuration management), DE.CM-09 (software and runtime environments monitored), DE.AE-02 (adverse events analysed) |
| CIS Controls v8.1 | Control 4 Secure Configuration, Control 5 Account Management, Control 8 Audit Log Management |
Practitioner checklist
- Enable Audit Other Object Access Events (Success) everywhere and forward 4698 to 4702.
- Alert on tasks in the library root, tasks running from user-writable paths and tasks created remotely.
- Find and replace every task that stores a password.
- Add auditd watches on cron and systemd unit paths and alert on writes outside configuration management.
- Restrict crontab creation with
cron.allowand removeatwhere unused. - Audit Kubernetes CronJob creation and limit it to deployment identities.
- Run a daily inventory diff of scheduled jobs and give every non-system job an owner.
- Rotate credentials used by any job an intruder created or modified.
Standards and references
- MITRE ATT&CK: Scheduled Task/Job (T1053)
- MITRE ATT&CK: Scheduled Task (T1053.005)
- MITRE ATT&CK: Container Orchestration Job (T1053.007)
- Microsoft Learn: 4698 A scheduled task was created
- Microsoft Learn: Audit Other Object Access Events
- freedesktop.org: systemd.timer
- MITRE D3FEND: Scheduled Job Analysis
Related NHI Mgmt Group resources: Persistence Techniques Guide · T1543 Create or Modify System Process Defensive Guide · ATT&CK Execution Tactic Guide · Linux Logging and auditd for Defenders Guide · Sysmon Guide