216.73.217.64

T1603: Scheduled Task/Job

View on MITRE ATT&CK The MITRE Corporation · Published 04/11/2020 17:43 · Modified 27/03/2026 01:41

Essential information

MITRE technique ID
T1603
Confidence
100/100
Revoked
No
Published
04/11/2020 17:43
Modified
27/03/2026 01:41
Author / Source
The MITRE Corporation

Aliases

T1603

Platforms

android iOS

Description

Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. On Android and iOS, APIs and libraries exist to facilitate scheduling tasks to execute at a specified date, time, or interval. On Android, the `WorkManager` API allows asynchronous tasks to be scheduled with the system. `WorkManager` was introduced to unify task scheduling on Android, using `JobScheduler`, `GcmNetworkManager`, and `AlarmManager` internally. `WorkManager` offers a lot of flexibility for scheduling, including periodically, one time, or constraint-based (e.g. only when the device is charging).(Citation: Android WorkManager) On iOS, the `NSBackgroundActivityScheduler` API allows asynchronous tasks to be scheduled with the system. The tasks can be scheduled to be repeating or non-repeating, however, the system chooses when the tasks will be executed. The app can choose the interval for repeating tasks, or the delay between scheduling and execution for one-time tasks.(Citation: Apple NSBackgroundActivityScheduler)

Kill chain phases

Kill chainPhase
mitre-mobile-attack execution
mitre-mobile-attack persistence

Marking (TLP)

TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.

External references