T1053: Scheduled Task/Job
AI Answer
Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and (Source: MITRE ATT&CK T1053)
ATT&CK Mapping
| Field | Value |
|---|---|
| Technique ID | T1053 |
| Name | Scheduled Task/Job |
| Tactic | Execution (execution) |
| Platforms | Containers, ESXi, Linux, macOS, Network Devices, Windows |
| Sub-technique | No |
Why it matters
In the OpenTrojan knowledge graph, Scheduled Task/Job (T1053) is one of the highest-connectivity ATT&CK techniques: 2 MITRE STIX relationships reference this technique; 1 software families associated; 1 campaigns associated. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.
How attackers use it
Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1053). Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system. Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges). Similar to System Binary Proxy Execution, adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.
Detection
Not available — MITRE ATT&CK does not currently publish a structured detection strategy for this technique in the ingested dataset.
Mitigation
Not available — no MITRE course-of-action was found for this technique in the ingested dataset.
Related Software
- Lokibot
Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).
Related Campaigns
- 2025 Poland Wiper Attacks
Campaign associations are from MITRE ATT&CK STIX relationships.
References
Source Attribution
Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review
Start Investigation
Move from reading to investigating T1053 Scheduled Task/Job. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about T1053 Scheduled Task/Job?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.