Scheduled Task/Job: Scheduled Task

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task.

The deprecated at utility could also be abused by adversaries (ex: At (Windows)), though at.exe can not access tasks created with schtasks or the Control Panel.

An adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence. The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account (such as SYSTEM).

ID: T1053.005
Sub-technique of:  T1053
Tactics: Execution, Persistence, Privilege Escalation
Platforms: Windows
Permissions Required: Administrator
Data Sources: File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Supports Remote:  Yes
Version: 1.0
Created: 27 November 2019
Last Modified: 24 March 2020

Procedure Examples

Name Description
Anchor

Anchor can create a scheduled task for persistence.[1]

APT-C-36

APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google.[2]

APT29

APT29 used named and hijacked scheduled tasks to establish persistence.[3]

APT3

An APT3 downloader creates persistence by creating the following scheduled task: schtasks /create /tn "mysc" /tr C:\Users\Public\test.exe /sc ONLOGON /ru "System".[4]

APT32

APT32 has used scheduled tasks to persist on victim systems.[5][6][7][8]

APT33

APT33 has created a scheduled task to execute a .vbe file multiple times a day.[9]

APT39

APT39 has created scheduled tasks for persistence. [10][11]

APT41

APT41 used a compromised account to create a scheduled task on a system.[12]

Attor

Attor's installer plugin can schedule a new task that loads the dispatcher on boot/logon.[13]

BackConfig

BackConfig has the ability to use scheduled tasks to repeatedly execute malicious payloads on a compromised host.[14]

BADNEWS

BADNEWS creates a scheduled task to establish by executing a malicious payload every subsequent minute.[15]

Blue Mockingbird

Blue Mockingbird has used Windows Scheduled Tasks to establish persistence on local and remote hosts.[16]

BONDUPDATER

BONDUPDATER persists using a scheduled task that executes every minute.[17]

BRONZE BUTLER

BRONZE BUTLER has used schtasks to register a scheduled task to execute malware during lateral movement.[18]

Carbon

Carbon creates several tasks for later execution to continue persistence on the victim’s machine.[19]

Chimera

Chimera has used scheduled tasks to invoke Cobalt Strike and maintain persistence.[20]

Cobalt Group

Cobalt Group has created Windows tasks to establish persistence.[21]

ComRAT

ComRAT has used a scheduled task to launch its PowerShell loader.[22]

CosmicDuke

CosmicDuke uses scheduled tasks typically named "Watchmon Service" for persistence.[23]

CozyCar

One persistence mechanism used by CozyCar is to register itself as a scheduled task.[24]

Dragonfly 2.0

Dragonfly 2.0 used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files.[25][26]

Duqu

Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.[27]

Dyre

Dyre has the ability to achieve persistence by adding a new task in the task scheduler to run every minute.[28]

Emotet

Emotet has maintained persistence through a scheduled task. [29]

Empire

Empire has modules to interact with the Windows task scheduler.[30]

EvilBunny

EvilBunny has executed commands via scheduled tasks.[31]

FIN10

FIN10 has established persistence by using S4U tasks as well as the Scheduled Task option in PowerShell Empire.[32][30]

FIN6

FIN6 has used scheduled tasks to establish persistence for various malware it uses, including downloaders known as HARDTACK and SHIPBREAD and FrameworkPOS.[33]

FIN7

FIN7 malware has created scheduled tasks to establish persistence.[34][35][36][37]

FIN8

FIN8 has used scheduled tasks to maintain RDP backdoors.[38]

Frankenstein

Frankenstein has established persistence through a scheduled task using the command: /Create /F /SC DAILY /ST 09:00 /TN WinUpdate /TR , named "WinUpdate".[39]

Gamaredon Group

Gamaredon Group has created a scheduled task to launch an executable every 10 minutes.[40]

Gazer

Gazer can establish persistence by creating a scheduled task.[41][42]

Goopy

Goopy has the ability to maintain persistence by creating scheduled tasks set to run every hour.[7]

GravityRAT

GravityRAT creates a scheduled task to ensure it is re-executed everyday.[43]

GRIFFON

GRIFFON has used sctasks for persistence. [44]

Helminth

Helminth has used a scheduled task for persistence.[45]

HotCroissant

HotCroissant has attempted to install a scheduled task named "Java Maintenance64" on startup to establish persistence.[46]

IcedID

IcedID has created a scheduled task that executes every hour to establish persistence.[47]

InvisiMole

InvisiMole has used scheduled tasks named MSST and \Microsoft\Windows\Autochk\Scheduled to establish persistence.[48]

ISMInjector

ISMInjector creates scheduled tasks to establish persistence.[49]

JHUHUGIT

JHUHUGIT has registered itself as a scheduled task to run each time the current user logs in.[50][51]

Machete

The different components of Machete are executed by Windows Task Scheduler.[52]

Machete

Machete used scheduled tasks for persistence.[53]

Matroyshka

Matroyshka can establish persistence by adding a Scheduled Task named "Microsoft Boost Kernel Optimization".[54][55]

Maze

Maze has created scheduled tasks using name variants such as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update", to launch Maze at a specific time.[56]

MCMD

MCMD can use scheduled tasks for persistence.[57]

menuPass

menuPass has used a script (atexec.py) to execute a command on a target machine via Task Scheduler.[58]

MuddyWater

MuddyWater has used scheduled tasks to establish persistence.[59]

NotPetya

NotPetya creates a task to reboot the system one hour after infection.[60]

OilRig

OilRig has created scheduled tasks that run a VBScript to execute a payload on victim machines.[61][62][63]

Okrum

Okrum's installer can attempt to achieve persistence by creating a scheduled task.[64]

OopsIE

OopsIE creates a scheduled task to run itself every three minutes.[61][65]

Patchwork

A Patchwork file stealer can run a TaskScheduler DLL to add persistence.[66]

PowerSploit

PowerSploit's New-UserPersistenceOption Persistence argument can be used to establish via a Scheduled Task/Job.[67][68]

POWERSTATS

POWERSTATS has established persistence through a scheduled task using the command "C:\Windows\system32\schtasks.exe" /Create /F /SC DAILY /ST 12:00 /TN MicrosoftEdge /TR "c:\Windows\system32\wscript.exe C:\Windows\temp\Windows.vbe".[69]

POWRUNER

POWRUNER persists through a scheduled task that executes it every minute.[70]

Pteranodon

Pteranodon schedules tasks to invoke its components in order to establish persistence.[71]

QUADAGENT

QUADAGENT creates a scheduled task to maintain persistence on the victim’s machine.[62]

QuasarRAT

QuasarRAT contains a .NET wrapper DLL for creating and managing scheduled tasks for maintaining persistence upon reboot.[72]

Ramsay

Ramsay can schedule tasks via the Windows COM API to maintain persistence.[73]

Rancor

Rancor launched a scheduled task to gain persistence using the schtasks /create /sc command.[74]

Remexi

Remexi utilizes scheduled tasks as a persistence mechanism.[75]

RemoteCMD

RemoteCMD can execute commands remotely by creating a new schedule task on the remote system[76]

Revenge RAT

Revenge RAT schedules tasks to run malicious scripts at different intervals.[77]

RTM

RTM tries to add a scheduled task to establish persistence.[78][79]

schtasks

schtasks is used to schedule tasks on a Windows system to run at a specific date and time.[80]

ServHelper

ServHelper contains modules that will use schtasks to carry out malicious operations.[81]

Shamoon

Shamoon copies an executable payload to the target system by using Windows Admin Shares and then scheduling an unnamed task to execute the malware.[82][83]

Silence

Silence has used scheduled tasks to stage its operation.[84]

Smoke Loader

Smoke Loader launches a scheduled task.[85]

Soft Cell

Soft Cell established persistence for PoisonIvy by created a scheduled task.[86]

SoreFang

SoreFang can gain persistence through use of scheduled tasks.[87]

SQLRat

SQLRat has created scheduled tasks in %appdata%\Roaming\Microsoft\Templates\.[37]

Stealth Falcon

Stealth Falcon malware creates a scheduled task entitled "IE Web Cache" to execute a malicious file hourly.[88]

TEMP.Veles

TEMP.Veles has used scheduled task XML triggers.[89]

TrickBot

TrickBot creates a scheduled task on the system that provides persistence.[90][91][92]

Valak

Valak has used scheduled tasks to execute additional payloads and to gain persistence on a compromised host.[93][94][95]

Wizard Spider

Wizard Spider has used scheduled tasks establish persistence for TrickBot.[96]

yty

yty establishes persistence by creating a scheduled task with the command SchTasks /Create /SC DAILY /TN BigData /TR " + path_file + "/ST 09:30".[97]

zwShell

zwShell has used SchTasks for execution.[98]

Mitigations

Mitigation Description
Audit

Toolkits like the PowerSploit framework contain PowerUp modules that can be used to explore systems for permission weaknesses in scheduled tasks that could be used to escalate privileges. [99]

Operating System Configuration

Configure settings for scheduled tasks to force tasks to run under the context of the authenticated account instead of allowing them to run as SYSTEM. The associated Registry key is located at HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SubmitControl. The setting can be configured through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > Security Options: Domain Controller: Allow server operators to schedule tasks, set to disabled. [100]

Privileged Account Management

Configure the Increase Scheduling Priority option to only allow the Administrators group the rights to schedule a priority process. This can be configured through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Increase scheduling priority. [101]

User Account Management

Limit privileges of user accounts and remediate Privilege Escalation vectors so only authorized administrators can create scheduled tasks on remote systems.

Detection

Monitor process execution from the svchost.exe in Windows 10 and the Windows Task Scheduler taskeng.exe for older versions of Windows. [102] If scheduled tasks are not used for persistence, then the adversary is likely to remove the task when the action is complete. Monitor Windows Task Scheduler stores in %systemroot%\System32\Tasks for change entries related to scheduled tasks that do not correlate with known software, patch cycles, etc.

Configure event logging for scheduled task creation and changes by enabling the "Microsoft-Windows-TaskScheduler/Operational" setting within the event logging service. [103] Several events will then be logged on scheduled task activity, including: [104][105]

  • Event ID 106 on Windows 7, Server 2008 R2 - Scheduled task registered
  • Event ID 140 on Windows 7, Server 2008 R2 / 4702 on Windows 10, Server 2016 - Scheduled task updated
  • Event ID 141 on Windows 7, Server 2008 R2 / 4699 on Windows 10, Server 2016 - Scheduled task deleted
  • Event ID 4698 on Windows 10, Server 2016 - Scheduled task created
  • Event ID 4700 on Windows 10, Server 2016 - Scheduled task enabled
  • Event ID 4701 on Windows 10, Server 2016 - Scheduled task disabled

Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current scheduled tasks. [106]

Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Tasks may also be created through Windows system management tools such as Windows Management Instrumentation and PowerShell, so additional logging may need to be configured to gather the appropriate data.

References

  1. Dahan, A. et al. (2019, December 11). DROPPING ANCHOR: FROM A TRICKBOT INFECTION TO THE DISCOVERY OF THE ANCHOR MALWARE. Retrieved September 10, 2020.
  2. QiAnXin Threat Intelligence Center. (2019, February 18). APT-C-36: Continuous Attacks Targeting Colombian Government Institutions and Corporations. Retrieved May 5, 2020.
  3. Dunwoody, M. and Carr, N.. (2016, September 27). No Easy Breach DerbyCon 2016. Retrieved October 4, 2016.
  4. Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.
  5. Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017.
  6. Dahan, A. (2017, May 24). OPERATION COBALT KITTY: A LARGE-SCALE APT IN ASIA CARRIED OUT BY THE OCEANLOTUS GROUP. Retrieved November 5, 2018.
  7. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
  8. Dumont, R. (2019, March 20). Fake or Fake: Keeping up with OceanLotus decoys. Retrieved April 1, 2019.
  9. Security Response attack Investigation Team. (2019, March 27). Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.. Retrieved April 10, 2019.
  10. Hawley et al. (2019, January 29). APT39: An Iranian Cyber Espionage Group Focused on Personal Information. Retrieved February 19, 2019.
  11. Rusu, B. (2020, May 21). Iranian Chafer APT Targeted Air Transportation and Government in Kuwait and Saudi Arabia. Retrieved May 22, 2020.
  12. Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.
  13. Hromcova, Z. (2019, October). AT COMMANDS, TOR-BASED COMMUNICATIONS: MEET ATTOR, A FANTASY CREATURE AND ALSO A SPY PLATFORM. Retrieved May 6, 2020.
  14. Hinchliffe, A. and Falcone, R. (2020, May 11). Updated BackConfig Malware Targeting Government and Military Organizations in South Asia. Retrieved June 17, 2020.
  15. Levene, B. et al.. (2018, March 7). Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent. Retrieved March 31, 2018.
  16. Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved May 26, 2020.
  17. Wilhoit, K. and Falcone, R. (2018, September 12). OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government. Retrieved February 18, 2019.
  18. Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.
  19. ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.
  20. Cycraft. (2020, April 15). APT Group Chimera - APT Operation Skeleton key Targets Taiwan Semiconductor Vendors. Retrieved August 24, 2020.
  21. Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.
  22. Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.
  23. F-Secure Labs. (2014, July). COSMICDUKE Cosmu with a twist of MiniDuke. Retrieved July 3, 2014.
  24. F-Secure Labs. (2015, April 22). CozyDuke: Malware Analysis. Retrieved December 10, 2015.
  25. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.
  26. US-CERT. (2017, October 20). Alert (TA17-293A): Advanced Persistent Threat Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved November 2, 2017.
  27. Symantec Security Response. (2011, November). W32.Duqu: The precursor to the next Stuxnet. Retrieved September 17, 2015.
  28. hasherezade. (2015, November 4). A Technical Look At Dyreza. Retrieved June 15, 2020.
  29. US-CERT. (2018, July 20). Alert (TA18-201A) Emotet Malware. Retrieved March 25, 2019.
  30. Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.
  31. Marschalek, M.. (2014, December 16). EvilBunny: Malware Instrumented By Lua. Retrieved June 28, 2019.
  32. FireEye iSIGHT Intelligence. (2017, June 16). FIN10: Anatomy of a Cyber Extortion Operation. Retrieved June 25, 2017.
  33. FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved June 1, 2016.
  34. Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017.
  35. Gorelik, M.. (2017, June 9). FIN7 Takes Another Bite at the Restaurant Industry. Retrieved July 13, 2017.
  36. Carr, N., et al. (2018, August 01). On the Hunt for FIN7: Pursuing an Enigmatic and Evasive Global Criminal Operation. Retrieved August 23, 2018.
  37. Platt, J. and Reeves, J.. (2019, March). FIN7 Revisited: Inside Astra Panel and SQLRat Malware. Retrieved June 18, 2019.
  38. Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.
  39. Adamitis, D. et al. (2019, June 4). It's alive: Threat actors cobble together open-source pieces into monstrous Frankenstein campaign. Retrieved May 11, 2020.
  40. Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.
  41. ESET. (2017, August). Gazing at Gazer: Turla’s new second stage backdoor. Retrieved September 14, 2017.
  42. Kaspersky Lab's Global Research & Analysis Team. (2017, August 30). Introducing WhiteBear. Retrieved September 21, 2017.
  43. Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018.
  44. Namestnikov, Y. and Aime, F. (2019, May 8). FIN7.5: the infamous cybercrime rig “FIN7” continues its activities. Retrieved October 11, 2019.
  45. ClearSky Cybersecurity. (2017, January 5). Iranian Threat Agent OilRig Delivers Digitally Signed Malware, Impersonates University of Oxford. Retrieved May 3, 2017.
  46. Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020.
  47. Kimayong, P. (2020, June 18). COVID-19 and FMLA Campaigns used to install new IcedID banking malware. Retrieved July 14, 2020.
  48. Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.
  49. Falcone, R. and Lee, B. (2017, October 9). OilRig Group Steps Up Attacks with New Delivery Documents and New Injector Trojan. Retrieved January 8, 2018.
  50. ESET. (2016, October). En Route with Sednit - Part 1: Approaching the Target. Retrieved November 8, 2016.
  51. ESET Research. (2015, July 10). Sednit APT Group Meets Hacking Team. Retrieved March 1, 2017.
  52. ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.
  53. The Cylance Threat Research Team. (2017, March 22). El Machete's Malware Attacks Cut Through LATAM. Retrieved September 13, 2019.
  1. ClearSky Cyber Security and Trend Micro. (2017, July). Operation Wilted Tulip: Exposing a cyber espionage apparatus. Retrieved August 21, 2017.
  2. Minerva Labs LTD and ClearSky Cyber Security. (2015, November 23). CopyKittens Attack Group. Retrieved September 11, 2017.
  3. Brandt, A., Mackenzie, P.. (2020, September 17). Maze Attackers Adopt Ragnar Locker Virtual Machine Technique. Retrieved October 9, 2020.
  4. Secureworks. (2019, July 24). MCMD Malware Analysis. Retrieved August 13, 2020.
  5. PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.
  6. Reaqta. (2017, November 22). A dive into MuddyWater APT targeting Middle-East. Retrieved May 18, 2020.
  7. Chiu, A. (2016, June 27). New Ransomware Variant "Nyetya" Compromises Systems Worldwide. Retrieved March 26, 2019.
  8. Lee, B., Falcone, R. (2018, February 23). OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan. Retrieved July 16, 2018.
  9. Lee, B., Falcone, R. (2018, July 25). OilRig Targets Technology Service Provider and Government Agency with QUADAGENT. Retrieved August 9, 2018.
  10. Bromiley, M., et al.. (2019, July 18). Hard Pass: Declining APT34’s Invite to Join Their Professional Network. Retrieved August 26, 2019.
  11. Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.
  12. Falcone, R., et al. (2018, September 04). OilRig Targets a Middle Eastern Government and Adds Evasion Techniques to OopsIE. Retrieved September 24, 2018.
  13. Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.
  14. PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.
  15. PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.
  16. ClearSky Cyber Security. (2018, November). MuddyWater Operations in Lebanon and Oman: Using an Israeli compromised domain for a two-stage campaign. Retrieved November 29, 2018.
  17. Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.
  18. Kasza, A. and Reichel, D. (2017, February 27). The Gamaredon Group Toolset Evolution. Retrieved March 1, 2017.
  19. Meltzer, M, et al. (2018, June 07). Patchwork APT Group Targets US Think Tanks. Retrieved July 16, 2018.
  20. Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.
  21. Ash, B., et al. (2018, June 26). RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families. Retrieved July 2, 2018.
  22. Legezo, D. (2019, January 30). Chafer used Remexi malware to spy on Iran-based foreign diplomatic entities. Retrieved April 17, 2019.
  23. Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.
  24. Gannon, M. (2019, February 11). With Upgrades in Delivery and Support Infrastructure, Revenge RAT Malware is a Bigger Threat. Retrieved May 1, 2019.
  25. Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.
  26. Duncan, B., Harbison, M. (2019, January 23). Russian Language Malspam Pushing Redaman Banking Malware. Retrieved June 16, 2020.
  27. Microsoft. (n.d.). Schtasks. Retrieved April 28, 2016.
  28. Schwarz, D. and Proofpoint Staff. (2019, January 9). ServHelper and FlawedGrace - New malware introduced by TA505. Retrieved May 28, 2019.
  29. FireEye. (2016, November 30). FireEye Responds to Wave of Destructive Cyber Attacks in Gulf Region. Retrieved January 11, 2017.
  30. Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.
  31. Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved May 24, 2019.
  32. Baker, B., Unterbrink H. (2018, July 03). Smoking Guns - Smoke Loader learned new tricks. Retrieved July 5, 2018.
  33. Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019.
  34. CISA. (2020, July 16). MAR-10296782-1.v1 – SOREFANG. Retrieved September 29, 2020.
  35. Marczak, B. and Scott-Railton, J.. (2016, May 29). Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents. Retrieved June 8, 2016.
  36. Miller, S, et al. (2019, April 10). TRITON Actor TTP Profile, Custom Attack Tools, Detections, and ATT&CK Mapping. Retrieved April 16, 2019.
  37. Salinas, M., Holguin, J. (2017, June). Evolution of Trickbot. Retrieved July 31, 2018.
  38. Antazo, F. (2016, October 31). TSPY_TRICKLOAD.N. Retrieved September 14, 2018.
  39. Pornasdoro, A. (2017, October 12). Trojan:Win32/Totbrick. Retrieved September 14, 2018.
  40. Salem, E. et al. (2020, May 28). VALAK: MORE THAN MEETS THE EYE . Retrieved June 19, 2020.
  41. Duncan, B. (2020, July 24). Evolution of Valak, from Its Beginnings to Mass Distribution. Retrieved August 31, 2020.
  42. Reaves, J. and Platt, J. (2020, June). Valak Malware and the Connection to Gozi Loader ConfCrew. Retrieved August 31, 2020.
  43. John, E. and Carvey, H. (2019, May 30). Unraveling the Spiderweb: Timelining ATT&CK Artifacts Used by GRIM SPIDER. Retrieved May 12, 2020.
  44. Schwarz, D., Sopko J. (2018, March 08). Donot Team Leverages New Modular Malware Framework in South Asia. Retrieved June 11, 2018.
  45. McAfee® Foundstone® Professional Services and McAfee Labs™. (2011, February 10). Global Energy Cyberattacks: “Night Dragon”. Retrieved February 19, 2018.
  46. PowerSploit. (n.d.). Retrieved December 4, 2014.
  47. Microsoft. (2012, November 15). Domain controller: Allow server operators to schedule tasks. Retrieved December 18, 2017.
  48. Microsoft. (2013, May 8). Increase scheduling priority. Retrieved December 18, 2017.
  49. Loobeek, L. (2017, December 8). leoloobeek Status. Retrieved December 12, 2017.
  50. Satyajit321. (2015, November 3). Scheduled Tasks History Retention settings. Retrieved December 12, 2017.
  51. Microsoft. (n.d.). General Task Registration. Retrieved December 12, 2017.
  52. Microsoft. (2017, May 28). Audit Other Object Access Events. Retrieved June 27, 2019.
  53. Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.