Abusing Schtasks.exe for
#Persistence &
#Remote Task
#Execution
Schtasks.exe, a native Windows binary, has long been leveraged for legitimate task scheduling. It is still a powerful tool for persistence and lateral movement.
---
🧪 Local
#Persistence
A recurring task can be created to execute a
#payload (e.g., calculator) every minute:
schtasks /create /sc minute /mo 1 /tn "ReverseShell" /tr "cmd /c C:\Windows\System32\calc.exe"
This tactic allows reverse shell sessions to be re-established persistently without user interaction.
---
🌐 Remote Task
#Execution
Lateral movement can be achieved by scheduling a task on a remote host:
schtasks /create /s targetmachine /tn "MyTask" /tr "cmd /c C:\Windows\System32\calc.exe" /sc daily
This command creates a persistent task on a target system, executing the desired payload once daily.
---
🛠️
#PoC Script (Python)
A minimal
#Python script can automate daily task creation using schtasks.exe, capable of stealthy persistence delivery. The payload is customizable, and execution can be elevated when needed.
MITRE ATT&CK Technique: T1053.005 - Scheduled Task/Job
-
github.com/Logisek/CalcOrItD…
---
Understanding how adversaries abuse built-in Windows tools like schtasks.exe is crucial for both defenders and
#RedTeamers. These binaries bypass many controls by design.
-
logisek.com
#CyberSecurity #LOLBAS #OffensiveSecurity #RedTeam #PenetrationTesting #BlueTeam #InfoSec #Offsec #Logisek