Scheduled Task Enumeration

$source sent several requests to retrieve information about scheduled tasks. Task information (such as hostname, task to run, and schedule) can help an attacker plan an attack campaign.

Microsoft Windows systems include a scheduled task feature that enables users to specify a time to run a script or program. An attacker can manipulate scheduled tasks to regularly run malicious programs, establishing a persistent presence on a victim device. Scheduled task enumeration is a reconnaissance technique an attacker can perform to determine which scheduled task to manipulate. First, an attacker must gain access to a victim device with a valid set of credentials and local administrator privileges. Next, the attacker can issue a command with a Windows utility (such as schtasks.exe). The utility sends multiple Microsoft remote procedure calls (MSRPC) to query each scheduled task about specific information such as the schedule name and the scheduled start time.