Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

Detecting Persistent Scheduled Tasks

Discover how threat actors abuse Scheduled Tasks for persistence and how to detect this abuse.

Task 1: Introduction

Task 2: Scheduled Task from a Legitimate Perspective

Task 3: Scheduled Task from an Adversary Perspective

Task 4: Detecting Scheduled Tasks with Event Logs

Task 5: Detecting Scheduled Tasks with DFIR Artifacts

Task 6: Containment, Prevention and Mitigation

Task 7: Hands-On Investigation

Task 8: Conclusion

Back to all walkthroughs
Room Icon

Detecting Persistent Scheduled Tasks

Max room.

Discover how threat actors abuse Scheduled Tasks for persistence and how to detect this abuse.

medium

90 min

151

User profile photo.
User profile photo.

To access material, start machines and answer questions login.

Scheduled Tasks are one of the most commonly abused mechanisms in Windows environments. 

While Scheduled Tasks are widely used by administrators and legitimate software for automation, attackers frequently leverage them to maintain long-term access, execute malicious payloads, or re-establish footholds after reboots. Approaching Scheduled Tasks from a perspective, you will learn how to identify, analyze, and validate Scheduled Task-based persistence during real-world investigations.

Learning Objectives

In this room, you will:

  • Discover how Windows Scheduled Tasks are used for persistence.
  • Understand how to detect malicious Scheduled Tasks in Windows logs.
  • Learn DFIR workflows for investigating Scheduled Tasks.
  • Practice analyzing Scheduled Tasks in real-world scenarios.

Prerequisites

Before starting this room, you should be familiar with:

  • Basic Windows internals
  • Windows Event Logs
  • Fundamental incident response concepts
  • Previous Windows -focused rooms

Launch DefenseBox by clicking Start DefenseBox and use this machine for practical exercises. You can also connect over OpenVPN and using the credentials below.

DefenseBox Credentials

Username
 
DFIRUser
 
Password
 
Secure!
 
Connection via
 
RDP

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting the DefenseBox, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.
Defender machine
Status:Off

For all DFIR tasks, we highly recommend accessing DefenseBox and the target over OpenVPN and connecting via RDP. This speeds up triage and makes switching between the VMs easier.

Answer the questions below

Let's go!