[Attacks and Exploits] After a recent penetration test was conducted by the company's penetration testing team, a systems administrator notices the…

The log entries show the use of the Windows schtasks utility. The first command, schtasks /query, is used for reconnaissance to list existing scheduled tasks. The second command, schtasks /CREATE, establishes a new task that runs daily. In the context of a penetration test, this sequence is a classic technique for establishing persistence. By creating a scheduled task, the penetration tester ensures that their code (e.g., a reverse shell or beacon) will be executed automatically, allowing them to regain access to the system after a reboot or if the initial session is terminated.

A. User enumeration is performed with commands like net user or query user, not schtasks.

B. Determining user permissions involves commands such as whoami /groups or icacls, which are not shown in the logs.

C. While schtasks /query does view scheduled processes, this only describes the first action and misses the primary objective indicated by the schtasks /CREATE command.

1. MITRE ATT&CK® Framework. (2023). Scheduled Task/Job: Scheduled Task. Tactic: Persistence

Execution. Technique ID: T1053.005. The framework explicitly states

"Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code... This mechanism can be used for persistence."

2. Microsoft Corporation. (2023). schtasks create. Microsoft Learn. The official documentation details the /CREATE parameter's function: "Schedules a new task." This confirms the action of creating a persistent entry point.

3. Parisi

A. (2019). Windows Persistence Methods. SANS Institute InfoSec Reading Room. Page 6

Section "Scheduled Tasks". This paper from a reputable security training institution identifies Scheduled Tasks as a primary persistence mechanism

stating

"Task Scheduler is a built-in Windows component that allows for the scheduling of automated tasks... Attackers can leverage this for persistence by creating a scheduled task that runs a malicious payload."