Skip to content

Scheduled Task/Job

Technique · ATTACK:enterprise:T1053

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1053",
  "title": "Scheduled Task/Job",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1053",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--35dd844a-b219-4e2b-a6bb-efa9a75995a9",
  "external_id": "T1053",
  "domain": "enterprise",
  "created": "2017-05-31T21:30:46.977Z",
  "modified": "2026-05-12T15:12:00.626Z",
  "version": "2.5",
  "aliases": [

  ],
  "tactics": [
    "execution",
    "persistence",
    "privilege-escalation"
  ],
  "source_references": [
    {
      "source_name": "ProofPoint Serpent",
      "url": "https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain"
    },
    {
      "source_name": "TechNet Task Scheduler Security",
      "url": "https://technet.microsoft.com/en-us/library/cc785125.aspx"
    }
  ]
}

Explicit source assertions (12)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1053

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0695efe3-ed6b-4372-94d6-f509641c9238

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1053

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d50b715-96a2-4fd6-bf92-603ad90730fd

ATTACK:enterprise:T1053.003 → subtechnique-of → ATTACK:enterprise:T1053

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51194570-630f-4d23-ab45-234a0f048b94

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1053

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63c9cdd8-0e64-46dd-9459-3d64828b0cc7

TechNet Server Operator Scheduled Task

ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1053

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a0efacc-7005-4f1e-9fb8-047d8b703cf8

ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1053

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--85b5efa3-9bd0-4685-a211-78f17a3747c7

Talos Lokibot Jan 2021

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1053

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f09085f-c1cf-4321-89c4-17d93e774f6f

TechNet Scheduling Priority

ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1053

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9d4e8b44-90f8-4a10-8419-8187d4babf24

ATTACK:enterprise:T1053.005 → subtechnique-of → ATTACK:enterprise:T1053

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d5ffcd6e-be9e-4efe-9822-974f3838c7db

ATTACK:enterprise:T1053.006 → subtechnique-of → ATTACK:enterprise:T1053

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de73c6a8-fd33-469d-b7e4-e4f6edd823b9

ATTACK:enterprise:T1053.007 → subtechnique-of → ATTACK:enterprise:T1053

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dfeb0053-3513-4622-a5c0-a3554c8970a7

ATTACK:enterprise:T1053.002 → subtechnique-of → ATTACK:enterprise:T1053

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e7c8615b-2dd4-42a9-9535-2deed30ea8d7

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.