How can a scheduled task provide persistence?¶

A scheduled task can relaunch a command, script or program after the original access ends. Tasks are also normal mechanisms for updates, backup and administration, so an unusual entry is not automatically malicious.

Read the complete task definition¶

Preserve its identifier, name, creator, creation time, trigger, command, arguments, working directory, execution account and privilege. A harmless-looking name or executable can conceal malicious arguments or configuration.

Tasks may run at startup, login, a fixed time or another event. Establish whether the trigger occurred, whether the task was enabled and what its execution history records. Process, file and network evidence can confirm the result.

Creation does not prove execution; execution does not prove malicious purpose. Compare timing and definition with approved deployment, installer and remote-management records.

Connect the task to its origin and effect¶

A remote session or management platform may create a task that later runs under a different, more privileged account. Correlate the creation event to the originating account and process, then follow each run to its child processes and changes.

Preserve the definition and payload before deletion, and record responder disablement or alteration. Some systems retain limited history, making surrounding endpoint records especially important.