Scheduled Tasks

Scheduled tasks are used to execute or do a certain action at a set period of time.

Scheduled tasks can be used for userland or elevated persistence. There is a lot of flexibility on how to configure and when to trigger the task, these can be checked issuing “schtasks.exe /?"

An example of this is this one, where it will run everyday at 10:00

schtasks /create /tn ”tenoclock" /tr C:\executable /sc daily /st 10:00

or when the user's session is idle for 10 minutes

schtasks /create /tn "NotEvil" /tr NotEvil /sc onidle /i 10

To execute as system, we can add the following flag: /ru System