#hack100days : day 21d : Tinkered with schedtask and eventviewer. Exported a task set to go off of 4801 (Previous post said 4800, because another Windows 10 used this. So, gonna have to unpack that weirdness...) I imported it on another box, but no joy. Perms issue. Redid it in the context of the schedtask app and import worked, but stuck it in an unexpected location. Tried to run as system instead of my defined user... ...so, that's interesting. ...? #redteam #windows #persistence #cososec