The Windows Task Scheduler is a powerful tool for automating administrative tasks; however, attackers can also exploit it to maintain persistence, escalate privileges, or run malicious code unnoticed. This guide explains how to secure the Task Scheduler, reduce the risks of exploitation, and align with security best practices and compliance frameworks, such as CIS Benchmarks.
What You Will Learn
- What is the Windows Task Scheduler?
- How attackers exploit the Task Scheduler
- Which security risks arise when the Task Scheduler is left unhardened?
- Best practices for securing Task Scheduler.
- How CalCom CHS automates Task Scheduler hardening.
What is the Windows Task Scheduler
Windows Task Scheduler, previously known as Scheduled Tasks, is a powerful job scheduler built into Microsoft Windows. Its primary function is to launch computer programs or scripts at specific times or intervals predetermined by the user. Introduced as System Agent in Microsoft Plus! for Windows 95, Task Scheduler Windows has evolved into a core component of the Windows operating system. In fact, it serves as the foundation for the Windows PowerShell scheduled jobs feature, which was introduced in PowerShell v3.
Comparable to the cron utility in Unix-like operating systems, Task Scheduler offers administrators a legitimate tool for automating various processes. Tasks can be scheduled to run at specific times, triggered by a particular event, or executed repeatedly or a single time. With its user-friendly graphical user interface (GUI), the Windows Task Scheduler allows users to run scripts, launch applications, and perform various tasks both locally and remotely from another system.
Scheduled tasks are not limited to a single operating system, making them versatile and widely applicable across different environments. However, it’s essential to be aware of the location of scheduled tasks in the Windows Registry. The registry key for scheduled tasks is located in the SOFTWARE registry hive. This knowledge becomes particularly relevant when discussing potential abuse by attackers seeking to evade detection.
Task Scheduler Versions
Task Scheduler is available across multiple Windows versions, ensuring broad compatibility and accessibility for users.
- Windows 10
- Windows 8.1
- Windows 8
- Windows 7
- Windows Vista
- Windows Server 2022
- Windows Server 2019
- Windows Server 2016
- Windows Server 2012 R2
- Windows Server 2012
- Windows Server 2008 R2
- Windows Server 2008
Task Scheduler 1.0
Client requires Windows Vista or Windows XP. The server requires Windows Server 2008 or Windows Server 2003.
Task Scheduler 2.0
Client requires Windows Vista or later. Server requires Windows Server 2008 or later.
Windows Task Scheduler: A Target for Malicious Cyber Attacks
Windows scheduled task techniques vary across several tactics of the MITRE ATT&CK framework, including execution, persistence, and privilege escalation. Because of this, a defender’s approach to defending against attacks involving LotL tools must be multi-faceted. There are several ways an attacker can abuse scheduled tasks. Many of them are legitimate use cases, such as:
- Using scheduled tasks to initiate infections.
- Setting up scheduled tasks under the SYSTEM account to achieve persistence and enable lateral movement.
- Bypassing User Access Control (UAC) through Task Scheduler by selecting “Run with highest privileges.”
- Evading detection by disguising the process as trusted or signed.
- Evading detection by deleting the Security Descriptor (SD) registry value using SYSTEM privileges.
Attackers can also leverage various parameters with the “schtasks” command, such as change, delete, end, query, run, or create. These commands can be manipulated by attackers, disrupting the normal execution process and potentially leading to system compromise. These seemingly harmless parameters grant attackers significant power to inflict damage on a system or network.
Task Scheduler Windows: Vulnerabilities and Threats
From privilege escalation to the deployment of persistent malware, understanding Windows Task Scheduler vulnerabilities is crucial for enhancing the security of Windows-based systems. This includes vulnerabilities in the task scheduler library itself, which can be exploited if not properly secured.
Mitre Attack techniques utilizing Windows task scheduler
Adversaries exploit the Windows Task Scheduler to perform task scheduling for executing malicious code, both initially and in a recurring manner. Accessing the Task Scheduler can be achieved through various means in Windows. The schtasks utility allows for direct command-line execution, while the GUI interface within the Administrator Tools section of the Control Panel provides an alternative access point. Additionally, adversaries have been known to use a .NET wrapper for the Windows Task Scheduler or leverage the Windows netapi32 library to create scheduled tasks.
The deprecated at utility could also be abused by adversaries (ex, at.exe), though at.exe can not access tasks created with schtasks or the Control Panel.
To establish persistence, adversaries may utilize Windows Task Scheduler to run programs during system startup or at scheduled intervals. Furthermore, they may exploit it for remote execution as part of lateral movement or to execute processes under the context of a specific account, such as the SYSTEM account. Similar to System Binary Proxy Execution, adversaries exploit the Windows Task Scheduler to mask one-time execution under signed or trusted system processes, potentially.
To evade detection, adversaries resort to creating “hidden” scheduled tasks that are not visible to defender tools and manual queries used for enumerating tasks. One method involves deleting the associated Security Descriptor (SD) registry value, which requires SYSTEM permissions for deletion; thus, the task is hidden from schtasks /query and the Task Scheduler. Alternatively, adversaries may employ alternate techniques to conceal tasks, such as modifying metadata like the Index value within associated registry keys.
Hardening and security configuration of the Windows task scheduler
Hardening the Windows Task Scheduler offers significant business benefits. By automating tasks and enhancing security, companies can boost efficiency, save time, and mitigate costs associated with potential security breaches. This streamlined approach ensures consistent system performance, compliance with regulations, and a competitive edge in the market. It also allows strategic resource allocation, scalability, and long-term savings while enhancing employee satisfaction by minimizing manual tasks and fostering innovation. Find out more about Task Scheduler Windows Hardening here.
Specifying Credentials for Cyber Hygiene
You can specify the security context for a task by providing credentials in the ITaskFolder::RegisterTask or ITaskFolder::RegisterTaskDefinition method (TaskFolder).RegisterTask or TaskFolder.RegisterTaskDefinition for scripting) methods or by assigning a principal to the Principal Property of ITaskDefinition (TaskDefinition.Principal for scripting). If a principal is created for a task definition, and then the task definition is registered using the RegisterTaskDefinition method with different credentials specified in the method parameters, then the credentials specified in the RegisterTaskDefinition method will overwrite the credentials in the principal. If a principal is created for a task definition using XML. Then the XML for the task is registered using the RegisterTask method with different credentials specified in the method parameters, then the credentials specified in the RegisterTask method will overwrite the credentials in the principal.
You specify a user account or group when registering a task or specifying the principle for a task. The security context of the user account or group is used for the security context of the task. In these methods and properties, you also define the logon type. The logon type is defined by one of the constants in the TASK_LOGON_TYPE enumeration.
Tasks registered with the TASK_LOGON_PASSWORD or TASK_LOGON_S4U flag will only launch if the specified user has the Logon as Batch privilege enabled. Administrators and members of the Backup Operators group have this privilege enabled by default.
It is important to ensure that as part of the credential definition and configuring the operating system, “Log os as a batch job” is set to ‘Administrators’. Task Scheduler is often used for administrative purposes. Therefore, its use should be restricted in high-security environments to prevent the misuse of system resources or to prevent attackers from launching malicious code after gaining user-level access to a system. Note that if the enterprise is using optional components (e.g., ASP.NET, IIS7), it may be necessary to assign this user right to additional accounts that are required by those components. If they are not assigned these rights, the components may not function properly, which can impact their overall functionality.
User Account Control (UAC) Security for Tasks
User Account Control (UAC) lets users exercise general functionality, such as running programs and saving and modifying data, without exposing administrative privileges. This mechanism plays a crucial role in the local security architecture, particularly in regulating task privileges and execution rights. By default, a task runs with low-level privileges when UAC is turned on. Tasks can specify that they will run with elevated privileges or low privileges by setting a privilege level from the TASK_RUNLEVEL_TYPE enumeration for the RunLevel property of IPrincipal (Principal.RunLevel for scripting).
The value of the RunLevel property determines the privilege level at which a task’s actions will be run. If a task’s actions must have elevated privileges to run, then you must set the RunLevel property to TASK_RUNLEVEL_HIGHEST. If a task is registered using the Administrators group for the security context of the task, then you must also set the RunLevel property to TASK_RUNLEVEL_HIGHEST if you want to run the task.
If a task is registered using the Built-in Administrator account, the Local System account, or the Local Service account, the RunLevel property will be ignored. The property value will also be ignored if User Account Control (UAC) is turned off. The value of the RunLevel property doesn’t affect the permissions needed to run or delete a task.
Configure who can write, read, update, and delete a Windows scheduled task
The DACL file of the task can be changed, in which case the DACL defines which users have file write, read, execute, and delete permission. To set permissions for a task file, use the IRegisteredTask.SetSecurityDescriptor method or set the security descriptor when you register the task using the RegisterTask or RegisterTaskDefinition methods.
A user must have WriteDAC permission in addition to the read/write permissions to update a task if the task update requires a change to the DACL for the task.
Keep in mind that by default, a user who creates a task can read, update, delete, and run the task. Members of the Administrators group or the SYSTEM account can read, update, delete, and run any tasks. Members of the Users group, the LocalService account, and the NetworkService account can only read, update, delete, and run the tasks that they have created.
Reduce the Ability to Raise the Priority of a Scheduled Task
Raising the priority of a task to “real-time” can cause a DOS attack against the system/application, causing operational damage. Therefore, it is highly recommended to take the following steps to reduce the ability to raise the priority of scheduled tasks.
Describes the best practices, location, values, policy management, and security considerations for the increased scheduling priority security policy setting. Verify that only Administrators and the Windows Manager Group have the Increase scheduling priority user right assigned to them.
Remove/Limit Access to “schtasks.exe”
When a scheduled task is created, it is assigned a priority. This priority can be modified, authorized or unauthorized, to change it to a higher or lower priority. If a user with this permission increases the priority level of a process (e.g., to Real-Time), it would leave little processing time for all other processes, potentially leading to a Denial of Service (DoS) attack. To reduce the chance of an attacker modifying the priority of a scheduled task to a higher level, a Group Policy setting can be configured, under “Computer ConfigurationPoliciesWindows SettingsSecurity SettingsLocal PoliciesUser Rights AssignmentIncrease scheduling priority,” to allow only administrators to change this priority level.
Restrict Access to “at.exe”
To mitigate risks associated with “at.exe”, it is recommended to implement the following:
- Control User Permissions: Limiting access to “at.exe” involves managing user permissions. By default, regular users do not have permissions to access or use “at.exe.”
- Administrators, on the other hand, typically have the necessary permissions to utilize “at.exe.” It is crucial to ensure that only trusted individuals with appropriate privileges have access to this utility.
- Group Policy Settings: To restrict access to “at.exe,” administrators can modify Group Policy settings. Specifically, the Group Policy setting “Computer ConfigurationPoliciesWindows SettingsSecurity SettingsLocal PoliciesUser Rights AssignmentAccess this computer from the network” can be adjusted to limit access to “at.exe” only to authorized users or groups.
Auditing Windows Task Scheduler
When it comes to the Windows OS, events are generated and stored in event logs for storage and review, including those associated with scheduled tasks. The Windows Task Scheduler Operational Event Log (“%SystemRootWindowsSystem32winevtLogsMicrosoft-WindowsTaskScheduler%4Operational.evtx”) stores these events, as depicted in Figure 8.
As mentioned earlier, all activity related to scheduled tasks is logged in either the Windows Task Scheduler Operational Event Log or the Windows Security Event Log. Once the GPO setting for auditing object access events is activated, the system begins logging events. Here are some Event IDs that are useful to monitor during or before an incident:
Windows > Task Scheduler > Operational Event Log:
- 100: A scheduled task was started
- 4698: A scheduled task was created
- 101: A scheduled task has failed
- 4699: A scheduled task was deleted
- 102: A scheduled task has completed
- 4700: A scheduled task was enabled
- 106: A scheduled task was registered
- 4701: A scheduled task was disabled
- 107: A scheduled task triggered on the scheduler
- 4702: A scheduled task was updated
- 108: A scheduled task triggered on an event
- 110: A scheduled task triggered by a user
- 111: A scheduled task was terminated
- 141: A scheduled task was updated
- 142: A scheduled task was deleted
It’s important to note that Windows does not enable auditing for these events by default. The mentioned GPO must be enabled to ensure event logging. Additionally, enabling this auditing feature may result in a large number of events being generated.
Enterprises should ensure that they have sufficient log storage capacity and establish clear retention policies. Storage requirements and retention policies will vary for each enterprise. Furthermore, it’s worth considering that scheduled tasks can also be created using PowerShell or Windows Management Instrumentation (WMI), which may require additional logging. CIS Controls provides separate documentation for protecting against attacks utilizing PowerShell and/or WMI.
Key Takeaways
Here’s a bullet list of what you will learn from the Task Scheduler Windows Hardening Guide article:
- What Windows Task Scheduler is and why it’s commonly used for automation.
- How attackers exploit Task Scheduler for persistence, privilege escalation, and malware execution.
- Which security risks arise when the Task Scheduler is left unhardened?
- Best Practices and CIS Benchmark Recommendations for Securing the Task Scheduler.
- How CalCom CHS automates Task Scheduler hardening to ensure security and compliance without disrupting operations.
Secure Windows Task Scheduler with CalCom CHS
Take control of Windows Task Scheduler before attackers do. CalCom Hardening Suite (CHS) automates the enforcement of secure Task Scheduler policies, closing persistence backdoors and ensuring compliance with CIS and industry standards—all without disrupting your production systems. Strengthen your defenses with automated hardening you can trust.
