Created
September 12, 2025 16:12
-
-
Save justaguywhocodes/7436580d79a9172c29912351d3c8fcd1 to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# Create a COM object for the Task Scheduler service | |
$service = New-Object -ComObject Schedule.Service | |
# Connect to the local Task Scheduler service | |
$service.Connect() | |
# Get the root task folder | |
$rootFolder = $service.GetFolder("\") | |
# Create a new task definition | |
$taskDefinition = $service.NewTask(0) | |
# Set task properties (e.g., compatibility with Task Scheduler 2.0, run with highest privileges) | |
$taskDefinition.RegistrationInfo.Description = "Simulated Persistence Task" | |
$taskDefinition.Settings.Compatibility = 3 # V2 compatibility | |
$taskDefinition.Principal.RunLevel = 1 # HighestAvailable | |
# Create a trigger (e.g., daily trigger for persistence simulation) | |
$trigger = $taskDefinition.Triggers.Create(2) # 2 = Daily trigger | |
$trigger.StartBoundary = (Get-Date).ToString("yyyy-MM-ddT00:00:00") | |
$trigger.DaysInterval = 1 | |
# Create an action (e.g., execute a command or script; replace with your payload simulation, like echoing to a file) | |
$action = $taskDefinition.Actions.Create(0) # 0 = Exec action | |
$action.Path = "cmd.exe" | |
$action.Arguments = "/c echo 'Persistence simulated' >> C:\persistence_log.txt" | |
# Register the task in the root folder (name it something innocuous) | |
$rootFolder.RegisterTaskDefinition("PersistenceTask", $taskDefinition, 6, $null, $null, 3) # 6 = CreateOrUpdate, 3 = LogonType InteractiveToken | |
``` |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment