Hunting For Scheduled Task Persistence
FreeProactively hunt for Windows scheduled task threats.
Free · Opens the source repo
What Hunting For Scheduled Task Persistence does
Hunting For Scheduled Task Persistence is a specialized skill designed for cybersecurity professionals focusing on threat detection and incident response. This skill enables users to conduct hypothesis-driven hunts for potential persistence mechanisms utilized by threat actors through Windows Scheduled Tasks. By leveraging telemetry data from EDR and SIEM platforms, the skill guides users through a structured process to identify and investigate suspicious scheduled task activities, which can be indicative of malicious behavior.
The skill operates by first formulating a hypothesis based on threat intelligence or analysis of existing security gaps. Users are then prompted to identify the necessary data sources, such as Windows Security Event Logs and EDR telemetry, to validate their hypothesis. The execution of targeted queries against these data sources allows for the collection of relevant events that can reveal anomalies associated with scheduled task creation and execution. Through careful analysis and correlation of these findings, users can distinguish between benign and malicious activities, ultimately enhancing their organization's security posture.
This skill is particularly useful in scenarios where threat intelligence indicates the use of scheduled tasks for persistence, such as during incident response or security assessments. It provides a systematic approach to hunting for indicators of compromise related to techniques outlined in the MITRE ATT&CK framework, specifically T1053, which covers scheduled task exploitation. By documenting findings and updating detection rules, users can continuously improve their threat detection capabilities and respond effectively to emerging threats.
Designed for security analysts and incident responders, this skill is best utilized in environments equipped with robust EDR and SIEM solutions, as well as comprehensive logging through Sysmon. It is an essential tool for organizations aiming to proactively detect and mitigate threats that leverage scheduled tasks for persistence.
When to use it
Use this skill when actively hunting for scheduled task persistence threats or responding to alerts related to task creation and execution.
When not to use it
This skill may not be suitable for environments lacking EDR or SIEM capabilities, or where comprehensive logging is not implemented.
What you can build with it
Investigating Suspicious Task Creation
Use this skill to run queries on task creation events when alerts are triggered by EDR or SIEM.
Responding to Threat Intelligence Alerts
Employ this skill to hunt for scheduled tasks when threat intel indicates active campaigns using such techniques.
Conducting Security Assessments
Utilize this skill during periodic assessments to identify potential scheduled task persistence mechanisms.
How to install Hunting For Scheduled Task Persistence
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/hunting-for-scheduled-task-persistence --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Hunting For Scheduled Task Persistence
When to Use
- When proactively hunting for indicators of hunting for scheduled task persistence in the environment
- After threat intelligence indicates active campaigns using these techniques
- During incident response to scope compromise related to these techniques
- When EDR or SIEM alerts trigger on related indicators
- During periodic security assessments and purple team exercises
Prerequisites
- EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
- SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
- Sysmon deployed with comprehensive configuration
- Windows Security Event Log forwarding enabled
- Threat intelligence feeds for IOC correlation
Workflow
- Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
- Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
- Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
- Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
- Validate Findings: Distinguish true positives from false positives through contextual analysis.
- Correlate Activity: Link findings to broader attack chains and threat actor TTPs.
- Document and Report: Record findings, update detection rules, and recommend response actions.
Key Concepts
| Concept | Description |
|---|---|
| T1053.005 | Scheduled Task |
| T1053.003 | Cron |
| T1053.002 | At |
Tools & Systems
| Tool | Purpose |
|---|---|
| CrowdStrike Falcon | EDR telemetry and threat detection |
| Microsoft Defender for Endpoint | Advanced hunting with KQL |
| Splunk Enterprise | SIEM log analysis with SPL queries |
| Elastic Security | Detection rules and investigation timeline |
| Sysmon | Detailed Windows event monitoring |
| Velociraptor | Endpoint artifact collection and hunting |
| Sigma Rules | Cross-platform detection rule format |
Common Scenarios
- Scenario 1: Cobalt Strike persistence via schtasks creating periodic beacon
- Scenario 2: Ransomware scheduled task for re-execution after reboot
- Scenario 3: APT encoded PowerShell task running every 30 minutes
- Scenario 4: Insider task to periodically copy sensitive files
Output Format
Hunt ID: TH-HUNTIN-[DATE]-[SEQ]
Technique: T1053.005
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]
Frequently asked questions about Hunting For Scheduled Task Persistence
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.