Article detailing the mechanisms of malware persistence by use of the Task Scheduler.
Task scheduler
The Windows task Scheduler will start a program when a given event is triggered. That event can be based on a date and time, when the computers boots up, when a user logs in or when a specific event is logged. There are five event types, that can be used, these are:
• Error
• Warning
• Information
• Audit Success
• Audit Failure
Additional information…
The term ‘scheduled tasks’ and ‘scheduled jobs’ are sometimes used interchangeably. Note whilst they both perform very similar functions they are performed by different software. Scheduled tasks is a program native to the Windows operating System and a scheduled job is native to PowerShell.
Which to use? Well a rule of thumb is this, if you are running PowerShell commands or scripts or using tools that don’t write any output to a file, a scheduled job should be your preferred option!
Click here for more information on the task scheduler and here for more information on scheduled jobs.