E-SCH
schtasks
List Windows scheduled tasks, their triggers, and the commands they run.
OVERVIEW
schtasks is the built-in Windows CLI for the Task Scheduler (learn.microsoft.com). `schtasks /query /fo LIST /v` dumps every task’s schedule, run-as account, and command line — including tasks that live under deep folders and never show up in a casual GUI look. Weak ACLs on a task or a writable binary it launches are a common privilege-escalation finding.
Query is enumeration. `/create`, `/change`, and `/run` persist or execute code as another user and are logged. Only use those when post-exploitation on that host is in the rules of engagement. Prefer a verbose query and a copy of the output in the loot folder.
USE CASES
Practical use cases
- 01
Dumping all scheduled tasks and the command each one runs.
- 02
Finding tasks that run as SYSTEM or a privileged service account.
- 03
Spotting a writable script or binary referenced by a repeating task.
- 04
Recording task names and triggers as evidence for a report.
QUICK START
On a Windows host in scope, to see which scheduled tasks exist, who they run as, and which command line they fire — before treating any of them as a privilege-escalation lead.
- Confirm the Windows host is in scope for local enumeration.
- Run a verbose query and save the output.
- Filter for high-privilege run-as accounts and unexpected command lines.
- Do not create or run a task unless that host is approved for post-exploitation.
schtasks /query /fo LIST /vBEFORE YOU RUN IT
What to check before running it
schtasks /create and /change are persistence-class events; they need the same authorization as any other implant and will show up in Task Scheduler and Security logs.
A task that references a missing or writable path is a lead, not proof — verify the ACL on disk before reporting it as exploitable.
Querying a remote host with /s uses RPC and is visible on that host; confirm the remote name is in scope.