TF-MAL-ps1.schtasks

Description

ThreatFox malware family `ps1.schtasks`. Printable name: Schtasks.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• Scheduled Task/Job: Scheduled Task, Sub-technique T1053.005 ...
  web:attack.mitre.org

  Removal Of SD Value to Hide Schedule Task - Registry. Retrieved June 1, 2022. Microsoft Threat Intelligence Team & Detection and Response Team . (2022, April 12). Tarrask malware uses scheduled tasks for defense evasion. Retrieved June 1, 2022. Harshal Tupsamudre. (2022, June 20). Defending Against Scheduled Tasks. Retrieved July 5, 2022.

  2026-05-22 05:31 UTC
• Abuse of Scheduled Tasks and Windows Services
  web:blog.hunterstrategy.net

  Adversaries continue to exploit Windows scheduled tasks and services as core persistence mechanisms, leveraging techniques ranging from simple recurring task creation to advanced registry manipulation that renders malicious tasks invisible to standard enumeration tools. Recent campaigns by groups like TA397, HAFNIUM, and ransomware operators demonstrate evolving tactics, including schtasks ...

  2026-05-22 05:31 UTC
• Malware development: persistence - part 27. Scheduled Tasks. Simple C ...
  web:cocomelonc.github.io

  Malware development: persistence - part 27. Scheduled Tasks. Simple C example. 3 minute read ﷽ Hello, cybersecurity enthusiasts and white hackers! I've written a lot about various persistence methods but somehow I forgot to mention one simple technique. Today, I'm going to share another malware persistence technique: Scheduled Tasks. This is a classic method that attackers use to ...

  2026-05-22 05:31 UTC
• Threat Actors Weaponizing Windows Scheduled Tasks to Establish ...
  web:cybersecuritynews.com

  Attackers abuse Windows Scheduled Tasks for stealthy persistence, using schtasks .exe or PowerShell to evade detection in compromised systems.

  2026-05-22 05:31 UTC
• MITRE ATT&CK: Scheduled Task - Packt SecPro
  web:security.packt.com

  From the malware samples analyzed by Picus, 21,367 individual samples (or an 11% prevalence in all analyzed samples) contained evidence of scheduled task/job abuse. This is a common tactic that the adversary uses to avoid automatic detection, ensure persistence, and launch surprise attacks after lengthy periods of lying low.

  2026-05-22 05:31 UTC
• Malware Incident Response: The 7-Step Playbook for 2025 - Breachsense
  web:www.breachsense.com

  Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.

  2026-05-22 05:31 UTC
• Technical Approaches to Uncovering and Remediating Malicious ... - CISA
  web:www.cisa.gov

  It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

  2026-05-22 05:31 UTC
• Tarrask malware uses scheduled tasks for defense evasion
  web:www.microsoft.com

  Removal of SD value results in the scheduled task "disappearing" from " schtasks /query" and Task Scheduler. Microsoft Defender AV Hits: This query looks for Microsoft Defender AV detections related to Tarrask malware using SecurityAlerts table.

  2026-05-22 05:31 UTC
• Mitigating malware and ransomware attacks - The National Cyber Security ...
  web:www.ncsc.gov.uk

  How to defend organisations against malware or ransomware attacks.

  2026-05-22 05:31 UTC
• Revisiting Voldemort, HealthKick, and GOVERSHELL: A Technical Retrospective
  web:www.picussecurity.com

  Voldemort, HealthKick, and GOVERSHELL: three Chinese APT malware families using Google Sheets C2, DLL sideloading, and LLM-assisted development.

  2026-05-22 05:31 UTC

Only Available for Registered Users. Sign in to view.