Schedule periodic tasks

Paths:

c:\windows\system32\schtasks.exe
c:\windows\syswow64\schtasks.exe
Paths:

Detection: Services that gets created

Execute

Create a recurring task to execute every minute. Paths:

schtasks /create /sc minute /mo 1 /tn "Reverse shell" /tr c:\some\directory\revshell.exe
Paths: