Please enable JavaScript.

Coggle requires JavaScript to display documents.

Task Scheduler - Coggle Diagram

- - - - wmic /node:"192.168.179.128" /user:"afif" /password:"**" process call create "cmd.exe /c schtasks /create /tn 'OpenNotepad' /tr 'notepad.exe' /sc once /st 14:32"
      - Reference
        
        https://www.windows-active-directory.com/how-to-schedule-a-process-remotely-via-wmi.html
      - wmic /node:"<RemoteComputerName>" /user:"<Domain\Username>" /password:"<Password>" process call create "schtasks /run /TN <TaskName>"
    - - wmic process call create "schtasks.exe /create /tn 'MyTask' /tr 'notepad.exe' /sc once /st 14:55"
    - - https://drive.google.com/file/d/18yZ599POlxAtglWz8IO2L06sY_CqGQRH/view?usp=sharing
      - Elastic Log
        
        https://docs.google.com/document/d/1NqhEACi_Gig5AbNuqYLclFU8wBaZhrB9lCU4UJisrIM/edit?usp=sharing
  - - - https://learn.microsoft.com/en-us/powershell/module/scheduledtasks/?view=windowsserver2022-ps
    - - $taskName = "opencmd"
        $action = New-ScheduledTaskAction -Execute "cmd.exe"
        $trigger = New-ScheduledTaskTrigger -Once -At "11:54AM"
        Register-ScheduledTask -Action $action -Trigger $trigger -TaskName $taskName
    - - https://docs.google.com/document/d/1Kr5SoFmeoZKh6_QMQUuk9ll3it0GXQp82yXh_ZWUO7Q/edit?usp=sharing
    - - https://drive.google.com/file/d/18yZ599POlxAtglWz8IO2L06sY_CqGQRH/view?usp=sharing
      - Elastic log
        
        https://docs.google.com/document/d/11v20XW9_tQj55ZZ0pqrkOLFotCy7lESinQ6-KAxoGVI/edit?usp=sharing
  - - - https://www.action1.com/how-to-different-ways-to-create-scheduled-task-remotely/
    - - https://www.backup4all.com/how-to-create-a-new-task-using-windows-task-scheduler-kb.html?srsltid=AfmBOoo_vkev4dU3aozA_Jr7NThkJ5AZRvsB4DE4asRgy5yWAxg4IJCY
  - - - https://www.computerhope.com/schtasks.htm
    - - schtasks /create /tn "TaskName" /tr "C:\Path\To\Your\Script.txt" /sc daily /st 14:00
        schtasks /create /tn "TaskName" /tr "calc.exe" /sc daily /st 14:00
    - - schtasks /Create /S <RemoteComputerName> /U <Username> /P <Password> /TN <TaskName> /TR <TaskRun> /SC <ScheduleType> /ST <StartTime>
        schtasks /Create /S 192.168.179.128 /U afif /P afif123 /TN test /TR calc.exe /SC ONCE /ST 15:14
    - - Event Logs
        
        Windows records task creation and execution events in the Event Viewer. You can find these logs under:
        
        Event Viewer > Applications and Services Logs > Microsoft > Windows > TaskScheduler.
        
        Look for Event IDs like 106 (task created) or 200 (task started).
        
        Event Viewer > Windows Log > Security.
        
        Reference: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/
        
        Reference
        
        https://betterstack.com/community/guides/logging/how-to-view-and-analyze-logs-with-windows-event-viewer/
      - Scheduled Task List
        
        schtasks /query /fo LIST /v
        
        This command lists all scheduled tasks with detailed information, which can reveal unauthorized tasks that may have been added or modified by an attacker.
      - sysmon
        
        https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
      - Elastic
    - - https://drive.google.com/file/d/18yZ599POlxAtglWz8IO2L06sY_CqGQRH/view?usp=sharing
      - Elastic
        
        https://docs.google.com/document/d/1jhJypY1V3ao-dVy2Qddyz6fn2YBdUm7RJ5Nq0TKSCxk/edit?usp=sharing
- - - - security.evtx
        
        4698 : Scheduled task was created, 4699: Scheduled task was deleted, 4700: Scheduled task was enabled, 4701: Scheduled task was disabled, 4702: Scheduled task was updated
        
        Disable by default
        
        To enable : auditpol /set /subcategory:"Other Object Access Events" /success:enable