Atomic Red T1053.005

Invoke-AtomicTest T1053.005

Executes the scheduled tasks atomic test (T1053.005) with Atomic Red Team, validating detection of persistence via Scheduled Tasks.

Run it in the purple team lab when you want to validate detection of persistence via scheduled tasks: the T1053.005 atomic creates a Scheduled Task (the atomic's method: schtasks /create) and the team checks what was detected — Sysmon Event 1 (schtasks), Event 4698, SIEM rules. It's the validation of persistence detection: the actual technique executed and coverage measured. In purple teaming, the atomic runs after deploying the rule and the result feeds the matrix.

Don't run it in production: the atomic creates the task (real persistence on the test host) — the lab is the place, and the task is cleaned up at the end (the atomic itself has cleanup). The noise is planned. And note: the atomic validates detection of task creation, not all variants — other creation methods (PowerShell, WMI) have other atomics; coverage is validated per variant. The test requires environment permissions; without them, task creation fails.