Identifier / Programs / Windows

schtasks.exe

Schedules commands and programs to run periodically or at a specific time, adds and removes tasks from the schedule, starts and stops tasks on demand, and displays and changes scheduled tasks. Windows commands reference

LOLBAS Execute 52 Sigma rules name it 3 ATT&CK techniques 2 documented commands 16 known copies with hashes

How schtasks.exe is abused

documented by LOLBAS

Execute T1053.005 Scheduled Task/Job: Scheduled Task

-create

-sc

-mo

-tn

-tr

Execute T1053.005 Scheduled Task/Job: Scheduled Task

-create

-s

-tn

-tr

-sc

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for schtasks.exe.

2 documented commands

from LOLBAS, each read by the identifier

Execute T1053.005 Scheduled Task/Job: Scheduled Task User privileges

Create a recurring task to execute every minute.

schtasks /create /sc minute /mo 1 /tn "Reverse shell" /tr "{CMD}"

Identify

Execute T1053.005 Scheduled Task/Job: Scheduled Task Administrator privileges

Create a scheduled task on a remote computer for persistence/lateral movement

schtasks /create /s targetmachine /tn "MyTask" /tr "{CMD}" /sc daily

Identify

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for schtasks.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for schtasks.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highRenamed Schtasks ExecutionSwachchhanda Shrawan Poudel (Nextron Systems)

highSuspicious Schtasks Execution AppData FolderpH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

highSchtasks From Suspicious FoldersFlorian Roth (Nextron Systems)

highSuspicious Schtasks Schedule TypesNasreddine Bencherchali (Nextron Systems)

highSchtasks Creation Or Modification With SYSTEM PrivilegesNasreddine Bencherchali (Nextron Systems)

mediumSchedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXEFlorian Roth (Nextron Systems)

mediumSuspicious Schtasks Schedule Type With High PrivilegesNasreddine Bencherchali (Nextron Systems)

lowScheduled Task Creation Via Schtasks.EXEFlorian Roth (Nextron Systems)

highPotential BearLPE ExploitationOlaf Hartong

highPotential CVE-2023-21554 QueueJumper ExploitationNasreddine Bencherchali (Nextron Systems)

highKapeka Backdoor Persistence ActivitySwachchhanda Shrawan Poudel

highForest Blizzard APT - Process Creation ActivityNasreddine Bencherchali (Nextron Systems)

highSuspicious BitLocker Access Agent Update Utility Executionandrewdanis, Swachchhanda Shrawan Poudel (Nextron Systems)

highHTML Help HH.EXE Suspicious Child ProcessMaxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)

highHackTool - Default PowerSploit/Empire Scheduled Task CreationMarkus Neis, @Karneades

highSuspicious Shells Spawn by Java Utility KeytoolAndreas Hunkeler (@Karneades)

highSuspicious Child Process Of Manage Engine ServiceDeskFlorian Roth (Nextron Systems)

highSuspicious Processes Spawned by Java.EXEAndreas Hunkeler (@Karneades), Florian Roth

highPotential Process Injection Via Msra.EXEAlexander McDonald

highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)

highSuspicious Outlook Child ProcessMichael Haag, Florian Roth (Nextron Systems), Markus Neis, Elastic, FPT.EagleEye Team

highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io

highPotentially Suspicious Child Process Of Regsvr32elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

highSuspicious ShellExec_RunDLL Call Via OrdinalSwachchhanda Shrawan Poudel

highSuspicious Modification Of Scheduled TasksNasreddine Bencherchali (Nextron Systems)

highSuspicious Scheduled Task Creation Involving Temp FolderFlorian Roth (Nextron Systems)

highDelete Important Scheduled TaskNasreddine Bencherchali (Nextron Systems)

highDelete All Scheduled TasksNasreddine Bencherchali (Nextron Systems)

highDisable Important Scheduled Taskfrack113, Nasreddine Bencherchali (Nextron Systems), X__Junior

highUncommon One Time Only Scheduled Task At 00:00pH-T (Nextron Systems)

And 22 more rules that name schtasks.exe.

T1036.003Masquerading: Rename Legitimate Utilities

T1053.005Scheduled Task/Job: Scheduled Task

T1059.001Command and Scripting Interpreter: PowerShell

Is it the real schtasks.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionTask Scheduler Configuration Tool

16 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\schtasks.exe · signed by Microsoft Windows

994cd15250e0b7310c26b9c5f58b37d0a1092b1582b8d0f084d75161779d5520

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\schtasks.exe · signed by Microsoft Windows

f3b81521032083407faf194b5c7230af4592b843898850618a138b9ae2d4fd2b

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\schtasks.exe · signed by Microsoft Windows

1ac5741b075111e49cb16b1bd3a00eef9b03ff6f34244ce05512da7b66165936

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\schtasks.exe · signed by Microsoft Windows

25b617e0c8d3fe9a4d3d70c1835b6676485b9767f19f4b4e93e8fe96df9f466a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\schtasks.exe · signed by Microsoft Windows

33c21c9dac8e26a6caf6d3f7d26dbe93674d196d567ab291b3793a34a8d8b8a0

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\schtasks.exe · signed by Microsoft Windows

356280cca63ca5e887fdbe5cb4105a53341fbac9219efc51621df9ba8ee9838b

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\schtasks.exe · signed by Microsoft Windows

9a121acf7686d2883e524332111d5e4bcc0c1a8e81136486fba4ca65ca614407

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\schtasks.exe · signed by Microsoft Windows

d94194bab0128bd8e26c9abb21dbabb60c4da9a5c682f4ec1b2a7ea6779e1ce5

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\schtasks.exe · signed by Microsoft Windows

97ca3fad547c4e0fe797db77c414213ba981bc4c39c05aa3e9e42c2a5d494139

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\schtasks.exe · signed by Microsoft Windows

d3222e48a036c6c730bb4e67b4c02e83c87860701975f408e5bf708b4b9cdbf4

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\schtasks.exe · signed by Microsoft Windows

72900a86f3bed7570aa708657a76dd76bb80b68db543d303da401ac6983e39ce

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\schtasks.exe · signed by Microsoft Windows

d6ba2cd73799477c051d9d864c47fcf5108064cde07d3565871afa10fc548086

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\schtasks.exe · signed by Microsoft Windows

a9a4fd9c1bb7c5cf8f77f761cae60f4ac4afb8daeebb46b3ad6983d5e599cdc1

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\schtasks.exe · signed by Microsoft Windows

caa9af113c1682ad8a6644342b37d96aa544f1af712d446bd29ef9f12ba30ca0

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\schtasks.exe · not signed

3441d2ca0928f7d90cf1d6818095160fa56716841e49fc15042934d7452cf376

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\schtasks.exe · not signed

fb024503622e00466f3c18fc69737f2c217fa39ef075718b25619b93ce3a1c62

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

schtasks.exe

How schtasks.exe is abused

2 documented commands

What detects it

Is it the real schtasks.exe?

16 known copies

Other programs abused for Execute