⏰ Scheduled Task Honey Lure

Fake scheduled tasks with embedded honeytokens.

→ Explore in ATT&CK matrix (7 mappings) Deployment detail

What it is

Create fake scheduled tasks or cron jobs that appear to run sensitive operations (e.g., backup-prod-db.ps1, sync-keys-from-vault.sh). When an attacker enumerates or modifies these tasks, it triggers a high-fidelity alert.

Implementation requirements

Windows: schtasks /create with realistic-looking task names pointing to honey scripts
Linux: Cron entries referencing honey scripts in /opt/ or /usr/local/bin/
Honey scripts must contain embedded honeytokens (fake API keys, DB connection strings)
Monitor: Windows Event 4698/4699 (Task Created/Deleted), Linux auditd on crontab access
Rollback: Delete the task or cron entry and the script it points to.
Upkeep: Check it survives rebuilds and configuration management, which can remove unknown tasks. Monthly proof-of-life read.

Technologies

LinuxWindows

ATT&CK coverage 7

Technique	Tactic	Status	Confidence	Tier
T1007 System Service Discovery	Discovery	theoretical	weak	T2
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1007 System Service Discovery as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1007 to its Lures activity. Listing services touches no decoy; querying a decoy service's configuration is not audited by default.
T1053 Scheduled Task/Job	Execution	theoretical	moderate	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) 4663(S) An attempt was made to access an object — Event 4663 records reads and writes on a file or registry key that carries an audit SACL. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1053 Scheduled Task/Job as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1053 to its Lures activity. The decoy task's contents are read, and its embedded token fires when used; creating a task touches no decoy.
T1053.003 Cron	Execution	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1053.003 Cron as an adversary behaviour. No source or audit signal sourced for decoy cron entries.
T1053.005 Scheduled Task	Execution	theoretical	moderate	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (2 sources) 4663(S) An attempt was made to access an object — Event 4663 records reads and writes on a file or registry key that carries an audit SACL. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1053.005 Scheduled Task as an adversary behaviour.
T1569 System Services	Execution	theoretical	moderate	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (2 sources) Cowrie — SSH and Telnet honeypot — Cowrie logs every session and every shell command an intruder runs on the honeypot. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1569 System Services as an adversary behaviour.
T1037 Boot or Logon Initialization Scripts	Persistence	theoretical	moderate	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (2 sources) 4663(S) An attempt was made to access an object — Event 4663 records reads and writes on a file or registry key that carries an audit SACL. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1037 Boot or Logon Initialization Scripts as an adversary behaviour. Reading credentials out of a decoy logon script is logged; the credential fires when used.
T1547 Boot or Logon Autostart Execution	Persistence	theoretical	moderate	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (2 sources) 4663(S) An attempt was made to access an object — Event 4663 records reads and writes on a file or registry key that carries an audit SACL. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1547 Boot or Logon Autostart Execution as an adversary behaviour. Reading the honey run key is logged (T1012); the credential inside fires when used.

Evidence

Deception Techniques in Computer Security: A Research Perspective — Han, X.; Kheir, N.; Balzarotti, D., ACM Computing Surveys 51(4) 2018 peer-reviewed
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: "Deception Techniques in Computer Security: A Research Perspective" — ResearchGate Survey, 2023.