# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# GH-ScheduledTask-v1_1-UserGuide

- 1
- 2
- 3
- 4

SECRET//NOFORN
1 Description
ScheduledTask is a Grasshopper component that provides a way to persist a
payload using the Windows Task Scheduler.
The ScheduledTask component uses the Windows Task Scheduler 1.0 COM interface
to create a new scheduled task. The component installs a stub executable as the
task; the stub is configured to run the input payload. The stub and payload are
stored at user specified locations on the target file system.
The scheduled task may be configured to trigger on either system startup or user
logon. The trigger can be configured to activate on a specific date; until the trigger
is activated, the task will not run. Once triggered, the task can remain active for a
specified duration. The task executable can be run periodically throughout the
duration by specifying an interval. The trigger can be configured to kill the task at
the end of the duration.
Once installed, the component will trigger the scheduled task immediately by
default. However, it can be configured to wait until triggered naturally. The task may
also be configured with a maximum run time.
2 Usage
2.1 Builder Command Line
add component scheduledtask -n NAME –t PATH –p PATH [–d DESC] [-r TYPE]
[--begin DATE] [--duration TIME] [--interval TIME]
[--kill-at-end] [--wait-to-run] [--max-run-time TIME]
[--stubname] [--killfile]
-n/--task-name NAME cover name of the scheduled task
-t/--task PATH target path of the task executable stub
-p/--payload PATH target path of the payload
-d/--description DESC cover description of the scheduled task
-r/--trigger TYPE trigger type {logon|startup} [default startup]
--begin DATE date to activate trigger (yyyy-mm-dd) [default today]
--duration TIME period for task to remain active once triggered [default
None]
--interval TIME interval to run task stub through duration [default None]
--kill-at-end kill task after duration [default False]
--wait-to-run wait until triggered to run [default False]
--max-run-time TIME maximum time task allowed to run [default INFINITE]
--stubname STUBNAME alternate stubname to use {A|B|ESET} [default A]
--killfile PATH Path of kill file, whose existence will cause the persistence
and payload to be uninstalled
2
SECRET//NOFORN

- 1
- 2
- 3
- 4