> Technique · Task Scheduler Persistence_

~/packetpursuit $ cat /intel/techniques/task-scheduler-persistence.md

typetechniqueconfidencehighcreated2026-08-15updated2026-08-15persistencescheduled-tasktask-schedulerwindows

Task Scheduler Persistence

Overview

Malware creating or modifying Windows Task Scheduler entries to survive reboots. The github.com/capnspacehook/taskmaster Go library wraps COM automation of the Task Scheduler 2.0 API (Schedule.Service), supporting boot, logon, daily, weekly, monthly, idle, and session-state-change triggers.

Observed In

  • afk-stealer — Go-based infostealer embedding taskmaster for persistence. ^[/intel/analyses/0b6c65cde50cae62eb3e15a9857193abd2ed130f8d73de6afc3e58ac2397c49a.html]

Detection

  • Event ID 106 (task registered), 140 (task updated), 200 (task executed).
  • schtasks /query /fo LIST /v or PowerShell Get-ScheduledTask.
  • Watch for tasks with empty Description, hidden flags, or actions pointing to %TEMP% or %APPDATA%.

ATT&CK Mapping

  • T1543.005 — Create or Modify System Process: Scheduled Task/Job

Related