Task scheduler managed wrapper

Task Scheduler Managed WrapperProvides a .NET wrapper for the Windows Task Scheduler. It aggregates the multiple versions, provides an editor and allows for localization.API documentation can be found at project's assemblies are available via NuGet.Main Library: Task Scheduler Managed Wrapper (TaskScheduler)UI Library: Task Scheduler Managed Wrapper UI Library (TaskSchedulerEditor)Project ComponentsMain LibraryMicrosoft introduced version 2.0 (internally version 1.2) with a completely new object model with Windows Vista. The managed assembly closely resembles the new object model, but allows the 1.0 (internally version 1.1) COM objects to be manipulated. It will automatically choose the most recent version of the library found on the host system (up through 1.4). Core features include:Separate, functionally identical, libraries for .NET 2.0 and 4.0.Unlike the base library, this wrapper helps to create and view tasks up and down stream.Written in C#, but works with any .NET language including scripting languages (e.g. PowerShell).Supports almost all V2 native properties, even under V1 systems.Maintain EmailAction and ShowMessageAction using PowerShell scripts for systems after Win8 where these actions have been deprecatedSupports all action types (not just ExecAction) on V1 systems (XP/WS2003) and earlier (if PowerShell is installed).Supports multiple actions on V1 systems (XP/WS2003). Native library only supports a single action.Supports serialization to XML for both 1.0 and 2.0 tasks (base library only supports 2.0)Supports task validation for targeted version.Supports secure task reading and maintenance.Fluent methods for task creation.Cron syntax for trigger creation.Supports reading "custom" triggers under Win8 and later.Numerous work-arounds and checks to compensate for base library shortcomings.The project supports a number of languages and, upon request, is ready to support others. The currently supported languages include: English, Spanish, Italian, French, Chinese (Simplified), German.The project is based on work the originator started in January 2002 with the 1.0 library that is currently hosted on CodeProject.UI LibraryThere is a second library that includes localized and localizable GUI editors and a wizard for tasks which mimic the ones in Vista and later and adds optional pages for new properties. Following is the list of available UI controls:A DropDownCheckList control that is very useful for selecting flag type enumerations.A FullDateTimePicker control which allows both

Task Scheduler Managed Wrapper The original .NET wrapper for the Windows Task Scheduler that aggregates the multiple versions and provides localized controls for editing.Quick LinksWiki - Sample code, library how-to, troubleshooting, etc.API documentation - Class/method/property documentation and examplesFull Issues Log - Use the search box to see if your question may already be answered.Discussion Forum - Users helping users, enhancement requests, Q&A (retired Google forum here)ITaskHandler Template and Sample Project - Use this to create your own COM based assembly for in-process actions.Troubleshooting Tool - Tool to help identify and fix configuration and connectivity issues. (ClickOnce installer here)InstallationThis project's assemblies are available via NuGet or manually from the .zip files in the Releases section.LinkPackage NameDescriptionTaskSchedulerMain LibraryTaskSchedulerEditorUI LibraryYou can also find prerelease NuGet pacakges on the project's AppVeyor NuGet feed.Once referenced by your project, all classes can be found in the Microsoft.Win32.TaskScheduler namespace.Project ComponentsMain LibraryMicrosoft introduced version 2.0 (internally version 1.2) with a completely new object model with Windows Vista. The managed assembly closely resembles the new object model, but allows the 1.0 (internally version 1.1) COM objects to be manipulated. It will automatically choose the most recent version of the library found on the host system (up through 1.4). Core features include:Separate, functionally identical, libraries for .NET 2.0, 3.5, 4.0, 4.52, 5.0, 6.0, .NET Standard 2.0, .NET Core 2.0, 2.1, 3.0, 3.1.Unlike the base COM libraries, this wrapper helps to create and view tasks up and down stream.Written in C#, but works with any .NET language including scripting languages (e.g.

And alternatively, adversaries have used the Windows netapi32 library to create a scheduled task. Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task. TA0004 Privilege Escalation Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task. Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task. * © 2025 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

To code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl. Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces. Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE). Remote COM execution is facilitated by Remote Services such as Distributed Component Object Model (DCOM). Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task. Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task. Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service’s executable or recovery programs/commands, is stored in the Windows Registry. TA0004 Privilege Escalation Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task. Adversaries may abuse the Windows Task Scheduler to perform

Class: Trojan A malicious program designed to electronically spy on the user’s activities (intercept keyboard input, take screenshots, capture a list of active applications, etc.). The collected information is sent to the cybercriminal by various means, including email, FTP, and HTTP (by sending data in a request).Read morePlatform: Win32 Win32 is an API on Windows NT-based operating systems (Windows XP, Windows 7, etc.) that supports execution of 32-bit applications. One of the most widespread programming platforms in the world. No family descriptionExamples 4239C6AF2EA2A32638BCF65B580BDE66 A40ABCF42100DC9FB8CE7F66EF508729 743EC230A3B79D4333A713C5E53970EE 85C1DC6C425B694C0FF37B5528A67C47 350D4D86B84F692F2BC68F0CDBBD731ATactics and Techniques: Mitre* Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task. Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task. Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility. Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler,