Hunting Scheduled Tasks: https://cherrabinesrine.github.io/posts/Hunting_Scheduled_Tasks/

#threathunting #windows #scheduledtask

Make sure that the first scheduled trigger of a #Windows #ScheduledTask lies in the future, due to a bug in Windows #TaskScheduler introduced with #Microsoft Windows Server 2016. The task will never start otherwise.

#TIL: when you use the #schtasks command in #MSWindows to update a #ScheduledTask, and you previously had the task switches to disabled, then schtasks will be happy to enable that task. Whether you like it or not.

#TodayILearned

#TIL: #MSWindows #ScheduledTask triggers must be scheduled to a future date in order to get kicked off automatically. Otherwise the #TaskScheduler will simply and silently ignore the trigger.

This is an unexpected change from older behavior, in which the operating system simply extrapolated the next run time and would trigger the task.

Also, if you schedule for daily execution, auto trigger won't kick in until tomorrow. Instead, schedule once with infinite repeat.

Lovely.

What the heck are you doing, #Microsoft #Windows?

At my wit's end, I have an idea. Maybe I can have the #MSDosBatch script create the drive letter so it will be available during the #ScheduledTask session? Yes, I can! With the #NetUse command.

On first try: fail! Drive letter already is mapped - 3/4

#TodayILearned: #Microsoft #Windows is terrible at #accessPrivileges.

I've got a #ScheduledTask that runs as a network user. I've done this a million times and I know how to get Windows to accept it.

This time, I need that task to run a #DosBatch script. It runs statements invoking #java and #DOS commands.

One of those is #MOVE. It only works on local disks, including mapped drive letters. It does not speak #UNC.

So I map a drive. I assign privileges to that network user - 1/4

How to make a #Windows #ScheduledTask run at a higher #CPU speed without altering your code:

https://docs.microsoft.com/en-us/windows/desktop/taskschd/tasksettings-priority