Impacket's atexec.py executes a supplied command on one remote Windows host through the Task Scheduler RPC service (TSCH over the atsvc named pipe). In its default mode it registers and runs a randomly named hidden task with a LocalSystem principal, redirects command output to a temporary file under %windir%\Temp, retrieves it through ADMIN$, and deletes the task and output file. It is a one-shot remote execution method; task and process activity can remain visible in configured Windows audit and endpoint telemetry.
Python
RESTRICTED_ACCESS_BLUR_MARKER