New Scheduled Task Activity (ATSVC)

Several types of operating systems include a scheduled task feature, which enables users to specify a time to run a script or program. Scheduled tasks can be registered on a device locally or remotely through Microsoft remote procedure call (MS-RPC) operations. First, an attacker must gain access to a target device with a valid set of credentials and local admin privileges (1). Then, the attacker sends an MS-RPC request with an operation for the task scheduler to register the scheduled tasks. The operation includes commands that run during specific times (2). For example, the attacker can schedule commands to run during a system startup, or schedule the delivery of periodic short messages, known as beacons, to a command-and-control server. Over time, an attacker can establish a persistent presence on the network, which could lead to other malicious purposes, such as exfiltrating data or cryptocurrency mining (3).