Scheduled Tasks (ATSVC)

Theory

Windows scheduled tasks can also be leveraged to run arbitrary commands since they execute a command when started. When using schtasks, it will try to connect to the Microsoft AT-Scheduler Service (ATSVC) remote service program through RPC in several ways:

• By using MS-TSCH protocols over RPC to connect EMP at port 135. WIll ask for the ATSVC RPC Endpoint wich is a dynamic port

• Try to reach ATSVC Through SMB named pipes (\PIPE\atsvc) on port 445 (SMB) or 139 (SMB over NetBIOS)

Practice

UNIX-like

The Impacket script atexec.py can be used to interact with Scheduled Tasks.

#Remotely exec a scheduled command 
atexec.py <domain>/<username>:<password>@<target> "whoami"

Windows

Resources

Lateral Movement and PivotingTryHackMe