.. / schtasks.exe

Create, delete, query, change, run and end scheduled tasks

Functions:	Execute Recon
Type:	Binaries
Toolsets:	Builtin

Execute

Create new task

schtasks.exe /S W10.ad.bitsadmin.com /Create /RU SYSTEM /SC HOURLY /TN "Microsoft\Windows\Printing\Print Spooler (x64)" /TR "C:\Windows\System32\spoolsv64.exe"

Usecases

Command execution through scheduled task
Persistence by registering a scheduled task

Mitre Att&ck
T1053.005

Recon

List tasks

schtasks.exe /S W10.ad.bitsadmin.com

Usecase
List current tasks to identify a name that can be used for a new task to blend in

Mitre Att&ck
T1053.005

Updated: 2023-11-04

Contributor: Arris Huijgen (bitsadmin)