Windows scheduled tasks

December 1, 2025

Your Windows PC has dozens of scheduled tasks running right now. Do you know what they all do? 🔍

One command shows everything. Most people never use it.

Open cmd and type:

schtasks /query /fo LIST

Now scroll through that list. Updates, maintenance, cloud sync, telemetry. But also… tasks you never created?

Most Windows users never look here. Attackers know this.

Task Scheduler is powerful. It runs programs automatically. At specific times. At startup. At logon. In the background. Silently.

Legitimate uses:

→ Windows Update checks → Antivirus scans → Cloud backup sync → Software license verification

Malicious uses: → Crypto miners that survive reboots → Backdoors that reconnect every hour → Data exfiltration on schedule → Malware that reinstalls itself after cleanup

Same tool. Different intentions.

What to look for:

Tasks running from:

→ C:[name]
→ C:
→ Any folder with random characters Tasks with:

→ PowerShell encoded commands → Connections to unknown URLs → Names that look legitimate but aren’t quite right

PowerShell alternative:

Get-ScheduledTask | Select-Object TaskName, State, TaskPath

This is MITRE ATT&CK technique T1053.005. Scheduled tasks for persistence. Used by real malware every day.

Because Task Scheduler does exactly what it’s designed to do. Run things automatically. Attackers just use it for their own purposes.

Want to understand how attackers exploit Windows systems? I cover Windows privilege escalation, credential dumping, and exploitation techniques in my ethical hacking course.

→ https://www.udemy.com/course/ethical-hacking-complete-course-zero-to-expert/

(The link supports me directly as your instructor!)

Knowledge is defense. Check your scheduled tasks. Know what’s running on your machine. 🎯 #EthicalHacking #Windows #CyberSecurity #InfoSec #TaskScheduler #PenetrationTesting #BlueTeam Research & writing: Jolanda de Koff | HackingPassion.com Sharing is fine. Copying without credit is not.

Reply via email