schtasks.exe is a legitimate Microsoft Windows command-line tool used to create, delete, query, change, run, and end scheduled tasks on a local or remote system. Located in C:\Windows\System32, it manages automated tasks, acting as a command-line interface for the Windows Task Scheduler. It is frequently used for system administration, but can also be used for persistence or privilege escalation in malicious activities
Zadanie uruchamiania skryptu cmd.
schtasks.exe /create /sc minute /mo 1 /tn "Write to Temp" /tr "C:\Windows\System32\cmd.exe /c C:\Users\Administrator\Scripts\test.cmd" /ru System
Skrypt
@echo off echo "success %time%" >> A:\test.log