MITRE ATT&CK T1053: Scheduled Task/Job (Enterprise Tactic TA0002 - Execution / TA0003 - Persistence / TA0004 - Privilege Escalation)

What MITRE ATT&CK T1053: Scheduled Task/Job (Enterprise Tactic TA0002 - Execution / TA0003 - Persistence / TA0004 - Privilege Escalation) requires

MITRE ATT&CK T1053 (Scheduled Task/Job) is an Enterprise Execution and Persistence and Privilege Escalation technique. Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). ATT&CK documents 5 sub-techniques: T1053.002 At; T1053.003 Cron; T1053.005 Scheduled Task; T1053.006 Systemd Timers; T1053.007 Container Orchestration Job. Affected platforms: Windows, Linux, macOS, Containers. MITRE-documented mitigations include M1018 User Account Management, M1028 Operating System Configuration, M1022 Restrict File and Directory Permissions, M1026 Privileged Account Management, M1047 Audit. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-02, AC-03, AC-05, AC-06, CM-02, CM-05, CM-06, CM-07.

Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated: 2026-05-25

Primary source: https://attack.mitre.org/techniques/T1053/

SHA-256 integrity: e2cb2c0f6a28965a8ce51e7420b74051c6269ca89f958351afecf05fe3e2361d

Primary Citations — 7 traced to source

• MITRE ATT&CK Technique T1053: Scheduled Task/Job (https://attack.mitre.org/techniques/T1053/) with 5 sub-techniques
• MITRE ATT&CK Tactic TA0002: Execution (https://attack.mitre.org/tactics/TA0002/)

+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.

Access

• Discovery (free): /api/v1/nodes/mitre-attack-t1053-scheduled-task-job.json — 6-field metadata
• Vault (full node): /api/v1/vault/nodes/mitre-attack-t1053-scheduled-task-job.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
• Canonical URL: https://bidda.com/intelligence/mitre-attack-t1053-scheduled-task-job
• Back to registry: Browse all 10,085 compliance nodes