schtasks
MITRE ATT&CK: S0111 View on attack.mitre.org
Aliases: schtasks.exe, schtasks
- Operating systems
- windows
- Profile updated
- 2026-07-07 14:39:18
Context
schtasks is used to schedule execution of programs or scripts on a Windows system to run at a specific date and time.
Detection coverage
- 31 Sigma rules
Malware & tools used
- Scheduled Task (attack-pattern)
Used by threat actors
- BRONZE BUTLER (threat-actor)
- APT3 (threat-actor)
- Kimsuky (threat-actor)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Ps1.Schtasks (report)
- github.com — Schtasks Backdoor.Ps1 (report)
- MITRE ATT&CK — S0111 (report)
- Microsoft — Bb490996 (report)