Windows Task Scheduler can launch an authorized program at logon or on a recurring schedule. In an assessment, an operator with sufficient rights may use this behavior to validate scheduled-task persistence; task creation and execution should be limited to the approved test scope.
Check before starting: RESTRICTED_ACCESS_BLUR_MARKER
Variant:
Full outcome coverage
Schtasks.Exe · Create Scheduled Task for Persistence
Create Scheduled Task for Persistence
powershell
RESTRICTED_ACCESS_BLUR_MARKER
Version: RESTRICTED_ACCESS_BLUR_MARKER. Requirements: none specified (operational prerequisites may still apply)Documents all requested outcomes. This is a candidate, not proof of execution or compatibility.preconditions: RESTRICTED_ACCESS_BLUR_MARKERverification: RESTRICTED_ACCESS_BLUR_MARKERfailure modes: RESTRICTED_ACCESS_BLUR_MARKERlimitations: RESTRICTED_ACCESS_BLUR_MARKERcleanup: RESTRICTED_ACCESS_BLUR_MARKER