{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/lotlbin/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["lateral-movement","persistence","living-off-the-land","windows","lotlbin"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe use of the Windows native utility 'schtasks.exe' to remotely create scheduled tasks is a frequent technique observed in lateral movement and persistence phases of an attack. By leveraging the '/create' and '/s' flags, an actor can execute commands or binaries on a remote target system without needing interactive access. This behavior is documented as a core component of several adversary campaigns, including the deployment of Prestige Ransomware, Phemedrone Stealer, and Quasar RAT, and has been observed in activity attributed to the NOBELIUM group. Because this technique relies on built-in living-off-the-land binaries (LotLBin), it is a high-utility method for attackers to maintain long-term access or move laterally within a compromised Active Directory environment. Defenders should monitor process-level telemetry for the invocation of schtasks.exe with flags indicative of remote targeting.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains initial access to an endpoint within the target network.\u003c/li\u003e\n\u003cli\u003eAttacker performs credential harvesting or token theft to obtain administrative privileges.\u003c/li\u003e\n\u003cli\u003eAttacker identifies a secondary target host via internal network reconnaissance.\u003c/li\u003e\n\u003cli\u003eAttacker executes schtasks.exe with the '/s' parameter to specify the remote host name and the '/create' flag to define a new task.\u003c/li\u003e\n\u003cli\u003eThe remote host schedules the attacker-defined task, often pointing to an obfuscated script or malicious binary.\u003c/li\u003e\n\u003cli\u003eThe scheduled task executes, providing the attacker with remote code execution (RCE) on the target host.\u003c/li\u003e\n\u003cli\u003eAttacker achieves persistence or pivots further into the network from the newly compromised host.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to gain unauthorized remote code execution, move laterally to sensitive systems, and establish persistent access. This technique has been observed across various sectors as part of multi-stage intrusions leading to ransomware deployment, data exfiltration, or long-term cyber espionage.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the implementation of process-creation monitoring to detect suspicious usage of native administrative tools.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule below to your SIEM to monitor for schtasks.exe remote execution attempts.\u003c/li\u003e\n\u003cli\u003eEnable Sysmon Event ID 1 or Windows Security Event ID 4688 to capture comprehensive command-line arguments for all processes.\u003c/li\u003e\n\u003cli\u003eReview all administrative scheduled task creation alerts in the context of the user identity and the destination host to filter out legitimate automated management tasks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T17:58:24Z","date_published":"2026-10-12T17:58:24Z","id":"https://feed.craftedsignal.io/briefs/2026-10-schtasks-remote-scheduling/","summary":"Adversaries utilize schtasks.exe with remote command-line arguments to establish persistence or facilitate lateral movement across Windows environments.","title":"Detection of Remote Scheduled Task Creation via Schtasks","url":"https://feed.craftedsignal.io/briefs/2026-10-schtasks-remote-scheduling/"}],"language":"en","title":"CraftedSignal Threat Feed - Lotlbin","version":"https://jsonfeed.org/version/1.1"}