2026-04-13 08-31-23

0:07

S… Speaker 2 (2026-04-13 08-31-23)

In this video,

0:08

S… Speaker 1 (2026-04-13 08-31-23)

we're going to take a look at scheduled tasks,

0:11

S… Speaker 1 (2026-04-13 08-31-23)

how attackers can abuse scheduled tasks,

0:14

S… Speaker 1 (2026-04-13 08-31-23)

and indicators we can use to search logs for

0:18

S… Speaker 1 (2026-04-13 08-31-23)

evidence of that type of malicious use.

0:21

S… Speaker 2 (2026-04-13 08-31-23)

So first of all,

0:22

S… Speaker 1 (2026-04-13 08-31-23)

let's just really quickly go over what scheduled tasks are and how they can be

0:26

S… Speaker 1 (2026-04-13 08-31-23)

used.

0:27

S… Speaker 1 (2026-04-13 08-31-23)

If you're not familiar.

0:28

S… Speaker 2 (2026-04-13 08-31-23)

So in Windows,

0:29

S… Speaker 1 (2026-04-13 08-31-23)

scheduled task is basically just some sort of automated way

0:33

S… Speaker 1 (2026-04-13 08-31-23)

to run some sort of a program or a script.

0:36

S… Speaker 1 (2026-04-13 08-31-23)

There's many different ways that these scheduled tasks,

0:40

S… Speaker 1 (2026-04-13 08-31-23)

these automations can be triggered.

0:41

S… Speaker 1 (2026-04-13 08-31-23)

You can have them done by date and time,

0:44

S… Speaker 1 (2026-04-13 08-31-23)

so you can have a scheduled task start.

0:47

S… Speaker 1 (2026-04-13 08-31-23)

at a specific date and time.

0:49

S… Speaker 1 (2026-04-13 08-31-23)

You can have them run at a regular interval,

0:52

S… Speaker 1 (2026-04-13 08-31-23)

maybe, you know,

0:52

S… Speaker 2 (2026-04-13 08-31-23)

once an hour,

0:53

S… Speaker 1 (2026-04-13 08-31-23)

once a day,

0:54

S… Speaker 1 (2026-04-13 08-31-23)

once every two weeks,

0:56

S… Speaker 1 (2026-04-13 08-31-23)

anything like that.

0:57

S… Speaker 1 (2026-04-13 08-31-23)

And you can have them run when the user logs in or

1:01

S… Speaker 1 (2026-04-13 08-31-23)

when Windows boots up.

1:03

S… Speaker 1 (2026-04-13 08-31-23)

Those two right there are two that are commonly used by

1:07

S… Speaker 1 (2026-04-13 08-31-23)

attackers, and we'll see why here in just a second.

1:10

S… Speaker 1 (2026-04-13 08-31-23)

You can also have triggers based on when the workstation is

1:14

S… Speaker 1 (2026-04-13 08-31-23)

locked or unlocked,

1:16

S… Speaker 1 (2026-04-13 08-31-23)

and there are a lot more triggers.

1:19

S… Speaker 1 (2026-04-13 08-31-23)

than just these.

1:21

S… Speaker 1 (2026-04-13 08-31-23)

These are just a few of the ones that are commonly used,

1:24

S… Speaker 1 (2026-04-13 08-31-23)

but there's a lot more than this.

1:26

S… Speaker 1 (2026-04-13 08-31-23)

Attackers will use scheduled tasks primarily and very frequently

1:31

S… Speaker 1 (2026-04-13 08-31-23)

for persistence mechanisms and being able

1:35

S… Speaker 1 (2026-04-13 08-31-23)

to have a more stealthier way of executing those persistence

1:39

S… Speaker 2 (2026-04-13 08-31-23)

mechanisms.

1:40

S… Speaker 1 (2026-04-13 08-31-23)

The scheduled tasks,

1:42

S… Speaker 2 (2026-04-13 08-31-23)

for example,

1:43

S… Speaker 1 (2026-04-13 08-31-23)

they could create one that

1:45

S… Speaker 1 (2026-04-13 08-31-23)

Verifies or ensures elevated access on an account

1:50

S… Speaker 1 (2026-04-13 08-31-23)

every time the computer reboots Or maybe once an hour

1:54

S… Speaker 1 (2026-04-13 08-31-23)

reaches out to a command and control server anything like that

1:58

S… Speaker 1 (2026-04-13 08-31-23)

So then how are they actually abusing these scheduled

2:02

S… Speaker 1 (2026-04-13 08-31-23)

tasks?

2:03

S… Speaker 1 (2026-04-13 08-31-23)

Number one is going to be by creating a new malicious

2:07

S… Speaker 1 (2026-04-13 08-31-23)

task.

2:07

S… Speaker 1 (2026-04-13 08-31-23)

And these are going to be very kind of similar to what we saw with malicious

2:12

S… Speaker 1 (2026-04-13 08-31-23)

Windows services as well.

2:14

S… Speaker 1 (2026-04-13 08-31-23)

So there's a few ways that attackers can

2:18

S… Speaker 1 (2026-04-13 08-31-23)

create malicious tasks here.

2:20

S… Speaker 1 (2026-04-13 08-31-23)

They can do it through the command line using the SCH tasks command

2:25

S… Speaker 1 (2026-04-13 08-31-23)

there with a forward slash.

2:26

S… Speaker 1 (2026-04-13 08-31-23)

create, so they can create a malicious task through the command line.

2:30

S… Speaker 1 (2026-04-13 08-31-23)

Of course,

2:31

S… Speaker 1 (2026-04-13 08-31-23)

there is a PowerShell method to do it as well with the commandlet of new

2:35

S… Speaker 1 (2026-04-13 08-31-23)

scheduled tasks.

2:36

S… Speaker 1 (2026-04-13 08-31-23)

And then they can do it through the GUI as well,

2:40

S… Speaker 1 (2026-04-13 08-31-23)

just using the task scheduler.

2:42

S… Speaker 1 (2026-04-13 08-31-23)

Now, this one you're not going to see as often.

2:45

S… Speaker 1 (2026-04-13 08-31-23)

because it requires them to,

2:47

S… Speaker 1 (2026-04-13 08-31-23)

you know,

2:47

S… Speaker 1 (2026-04-13 08-31-23)

have GUI access to the machine,

2:49

S… Speaker 1 (2026-04-13 08-31-23)

be logged into the machine itself,

2:51

S… Speaker 1 (2026-04-13 08-31-23)

whatever machine they're working on.

2:52

S… Speaker 2 (2026-04-13 08-31-23)

Typically,

2:53

S… Speaker 1 (2026-04-13 08-31-23)

you're going to see them done through command line methods,

2:58

S… Speaker 1 (2026-04-13 08-31-23)

excuse me, either command line or PowerShell.

3:00

S… Speaker 1 (2026-04-13 08-31-23)

But GUI is an option as well using just the built -in Windows

3:05

S… Speaker 1 (2026-04-13 08-31-23)

task scheduler.

3:06

S… Speaker 1 (2026-04-13 08-31-23)

This one can be a little more tricky to see in hunts.

3:10

S… Speaker 1 (2026-04-13 08-31-23)

There is still going to be an event logged in the Windows event

3:14

S… Speaker 1 (2026-04-13 08-31-23)

logs on the system for that,

3:17

S… Speaker 1 (2026-04-13 08-31-23)

but you're not going to have quite as much evidence of the task creation as

3:21

S… Speaker 1 (2026-04-13 08-31-23)

you would in something like command line or PowerShell.

3:23

S… Speaker 2 (2026-04-13 08-31-23)

So you can still detect it.

3:25

S… Speaker 1 (2026-04-13 08-31-23)

There's just not quite as much information.

3:28

S… Speaker 1 (2026-04-13 08-31-23)

In addition to creating malicious tasks,

3:31

S… Speaker 1 (2026-04-13 08-31-23)

attackers can also modify existing tasks that

3:35

S… Speaker 1 (2026-04-13 08-31-23)

might be on the system.

3:36

S… Speaker 1 (2026-04-13 08-31-23)

Now, again, this is going to require them to have access to be able to modify

3:41

S… Speaker 1 (2026-04-13 08-31-23)

the task,

3:41

S… Speaker 1 (2026-04-13 08-31-23)

and that's going to depend on the permissions they have on the system and the permissions

3:45

S… Speaker 1 (2026-04-13 08-31-23)

required to modify that individual task.

3:48

S… Speaker 1 (2026-04-13 08-31-23)

They can do this,

3:50

S… Speaker 1 (2026-04-13 08-31-23)

again, using that SCH tasks command with a forward slash change

3:54

S… Speaker 1 (2026-04-13 08-31-23)

instead.

3:55

S… Speaker 1 (2026-04-13 08-31-23)

They can also do this with another PowerShell command with set scheduled

4:00

S… Speaker 1 (2026-04-13 08-31-23)

task instead of new scheduled task.

4:03

S… Speaker 2 (2026-04-13 08-31-23)

Now,

4:04

S… Speaker 1 (2026-04-13 08-31-23)

with PowerShell,

4:05

S… Speaker 1 (2026-04-13 08-31-23)

remember, and this applies to any sort of PowerShell indicator you're searching

4:09

S… Speaker 1 (2026-04-13 08-31-23)

for, attackers are going to very commonly encode the PowerShell

4:14

S… Speaker 1 (2026-04-13 08-31-23)

command using Base64.

4:15

S… Speaker 1 (2026-04-13 08-31-23)

It is a built -in feature in PowerShell.

4:18

S… Speaker 2 (2026-04-13 08-31-23)

If that is done,

4:20

S… Speaker 2 (2026-04-13 08-31-23)

if it is an encoded command,

4:21

S… Speaker 1 (2026-04-13 08-31-23)

you are not going to find any results if you're searching for something

4:25

S… Speaker 1 (2026-04-13 08-31-23)

like new scheduled task or set scheduled task because it's part of the encoded

4:30

S… Speaker 1 (2026-04-13 08-31-23)

command.

4:30

S… Speaker 1 (2026-04-13 08-31-23)

All you will see is the encoded command.

4:33

S… Speaker 1 (2026-04-13 08-31-23)

So don't be fooled if you're searching for new scheduled tasks and you don't

4:37

S… Speaker 1 (2026-04-13 08-31-23)

find any of them in the logs,

4:39

S… Speaker 1 (2026-04-13 08-31-23)

but you're pretty sure there was one that was created.

4:42

S… Speaker 1 (2026-04-13 08-31-23)

Don't forget you want to search for any encoded PowerShell

4:46

S… Speaker 2 (2026-04-13 08-31-23)

commands as well.

4:47

S… Speaker 1 (2026-04-13 08-31-23)

Get those and then decode them and then you might see a new scheduled

4:51

S… Speaker 1 (2026-04-13 08-31-23)

task in there.

4:53

S… Speaker 1 (2026-04-13 08-31-23)

So keep that in mind when you're talking about searching and hunting for any

4:57

S… Speaker 1 (2026-04-13 08-31-23)

type of PowerShell command.

4:59

S… Speaker 1 (2026-04-13 08-31-23)

Now there's many different indicators we can look at and we just looked at a few of

5:03

S… Speaker 2 (2026-04-13 08-31-23)

them Let's take a look at all of them.

5:05

S… Speaker 1 (2026-04-13 08-31-23)

Here's kind of on one screen So you have them all for easy access

5:09

S… Speaker 2 (2026-04-13 08-31-23)

So number one,

5:11

S… Speaker 1 (2026-04-13 08-31-23)

the indicators you can search for for new scheduled

5:15

S… Speaker 1 (2026-04-13 08-31-23)

task creation.

5:16

S… Speaker 1 (2026-04-13 08-31-23)

So we talked about the SCH tasks command with the forward slash create.

5:20

S… Speaker 1 (2026-04-13 08-31-23)

That would be a command line indicator you can search for.

5:24

S… Speaker 1 (2026-04-13 08-31-23)

You have the PowerShell new scheduled task commandlet.

5:28

S… Speaker 1 (2026-04-13 08-31-23)

Then you also have a series of event IDs you can search

5:32

S… Speaker 1 (2026-04-13 08-31-23)

for. And these are built -in Windows events.

5:36

S… Speaker 1 (2026-04-13 08-31-23)

These are not Sysmon events.

5:38

S… Speaker 1 (2026-04-13 08-31-23)

So the first one is event ID 4698.

5:42

S… Speaker 1 (2026-04-13 08-31-23)

This is for a new scheduled task being created.

5:46

S… Speaker 1 (2026-04-13 08-31-23)

The second one is going to be event ID 4700.

5:51

S… Speaker 1 (2026-04-13 08-31-23)

This is for a scheduled task that has been created but also needs

5:55

S… Speaker 1 (2026-04-13 08-31-23)

to be enabled for it to run on whatever trigger that

5:59

S… Speaker 1 (2026-04-13 08-31-23)

has been configured.

6:01

S… Speaker 1 (2026-04-13 08-31-23)

Then you have in a kind of a different section or different channel

6:05

S… Speaker 1 (2026-04-13 08-31-23)

of the Windows event logs,

6:06

S… Speaker 1 (2026-04-13 08-31-23)

this is in a location that is dedicated just to

6:11

S… Speaker 1 (2026-04-13 08-31-23)

task scheduler events.

6:12

S… Speaker 1 (2026-04-13 08-31-23)

But you also have event ID 106.

6:16

S… Speaker 1 (2026-04-13 08-31-23)

This is the same thing essentially as 4698 with a scheduled

6:20

S… Speaker 1 (2026-04-13 08-31-23)

task being created.

6:22

S… Speaker 1 (2026-04-13 08-31-23)

Then you also have indicators for if an attacker

6:26

S… Speaker 1 (2026-04-13 08-31-23)

is modifying an existing scheduled task.

6:30

S… Speaker 2 (2026-04-13 08-31-23)

Again,

6:31

S… Speaker 1 (2026-04-13 08-31-23)

the SCH tasks command,

6:32

S… Speaker 1 (2026-04-13 08-31-23)

this time with the forward slash change as a command line indicator.

6:37

S… Speaker 1 (2026-04-13 08-31-23)

PowerShell indicator would be the set scheduled task.

6:41

S… Speaker 1 (2026-04-13 08-31-23)

And then with event IDs,

6:43

S… Speaker 1 (2026-04-13 08-31-23)

you have two of those you can look at.

6:45

S… Speaker 1 (2026-04-13 08-31-23)

The regular Windows event ID is 4702,

6:49

S… Speaker 1 (2026-04-13 08-31-23)

and the task scheduler channel event ID is 140,

6:54

S… Speaker 1 (2026-04-13 08-31-23)

and both of those are for a scheduled task being updated.

6:59

S… Speaker 2 (2026-04-13 08-31-23)

So again,

6:59

S… Speaker 1 (2026-04-13 08-31-23)

attackers will very commonly use scheduled tasks for persistence

7:04

S… Speaker 1 (2026-04-13 08-31-23)

mechanisms to ensure they have elevated access into

7:08

S… Speaker 1 (2026-04-13 08-31-23)

the system for command and control communication or really whatever

7:12

S… Speaker 1 (2026-04-13 08-31-23)

else their attack kind of requires for whatever they plan

7:16

S… Speaker 1 (2026-04-13 08-31-23)

on doing.

7:17

S… Speaker 1 (2026-04-13 08-31-23)

And there are many different ways you can find the

7:22

S… Speaker 1 (2026-04-13 08-31-23)

abuse of scheduled tasks in a threat hunt.

7:26

S… Speaker 1 (2026-04-13 08-31-23)

using many different types of indicators.

2026-04-13 08-31-23

Oversigt

Spørg AI om denne transskription