New Scheduled Task Activity (ITaskSchedulerService)

$source sent an MS-RPC request to a remote device to create a scheduled task. This is either the first time ever or the first time in several weeks that ExtraHop observed this type of request. Attackers can leverage scheduled tasks to run commands at regular intervals. Check if the new scheduled task is legitimate or if the device has been compromised.

Several types of operating systems include a scheduled task feature, which enables users to specify a time to run a script or program. Scheduled tasks can be registered on a device locally or remotely through Microsoft remote procedure call (MS-RPC) operations. First, an attacker must gain access to a target device with a valid set of credentials and local admin privileges (1). Then, the attacker sends an MS-RPC request with an operation for the task scheduler to register the scheduled tasks. The operation includes commands that run during specific times (2). For example, the attacker can schedule commands to run during a system startup, or schedule the delivery of periodic short messages, known as beacons, to a command-and-control server. Over time, an attacker can establish a persistent presence on the network, which could lead to other malicious purposes, such as exfiltrating data or cryptocurrency mining (3).