#hack100days : day 22d : Figured out my goof on 4800/4801. It's Lock/Unlock. Played around with schedtask to get a valid task on unlock. Took some experimentation, but got there. Got a good example exported as xml, so the next trick is writing a script to establish persistence after initial access. Concurrently I need to write the info gathering script(s). #redteam #windows #persistence #cososec