New Scheduled Task

Description

This persistence technique will create a new scheduled task based on the parameters specified by the user. In this module, you will provide a scheduled task name, and a system command to execute.

Privileges Required

• Non-admin privileges (creating scheduled task that triggers hourly or daily)
• Admin privileges (creating scheduled task that triggers at logon)

Arguments/Options Required

• -c - command to execute
• -a - arguments to command to execute (if applicable)
• -n - scheduled task name
• -m - method (add, remove, check, list)
• -o - optional add-on for frequency (logon, daily, hourly) if applicable

Changed Made to Target System/Caveats

Adding New Scheduled Task Persistence

• The task will be ran under the context of the user that created it. Unless task is created to be triggered at logon (requires admin privs) then it will run as SYSTEM.
• If no optional add-on for frequency (-o) is specified, then task will be created for daily trigger that will trigger between 10am and 12pm local time.

Removing New Scheduled Task Persistence

• Scheduled task is deleted

Usage/Examples

Adding New Scheduled Task Persistence Trigger (triggers daily by default with no frequency specified)

SharPersist -t schtask -c "C:\Windows\System32\cmd.exe" -a "/c calc.exe" -n "Some Task -m add

Adding New Scheduled Task Persistence Trigger (triggers at logon)

SharPersist -t schtask -c "C:\Windows\System32\cmd.exe" -a "/c calc.exe" -n "Some Task -m add -o logon

Removing New Scheduled Task Persistence Trigger

SharPersist -t schtask -n "Some Task" -m remove

Perform Dry Run of New Scheduled Task Persistence Trigger

SharPersist -t schtask -c "C:\Windows\System32\cmd.exe" -a "/c calc.exe" -n "Some Task" -m check

List All Scheduled Tasks

SharPersist -t schtask -m list

List All Scheduled Tasks by Name

SharPersist -t schtask -m list -n "Some Task"

List All Scheduled Tasks by Frequency

SharPersist -t schtask -m list -o logon

References

• https://github.com/dahall/taskscheduler
• https://attack.mitre.org/techniques/T1053/