Windows Service for User (S4U) Scheduled Task Persistence - Event Trigger
PoC files
1 fileFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
A Metasploit module that establishes persistence on a Windows target by creating a scheduled task triggered by a Windows Event Log event. It uploads a payload executable, generates a task XML definition with an event-based trigger, and uses schtasks to install the task, allowing code execution even when the user is not logged in.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit persistence exploit that creates a scheduled task triggered by a Windows event log entry. It uploads a user-supplied payload, generates task XML, and registers the task via schtasks. No concealed backdoor, credential theft, unrelated remote access, or deceptive behavior was observed.
Classification basis and observed behavior
Classification basis
The module is a Metasploit exploit that actively deploys a payload and creates a scheduled task to execute it, establishing persistence. It does not merely scan or detect; it performs the exploitation action.
modules/exploits/windows/persistence/service_for_user/event.rb:6modules/exploits/windows/persistence/service_for_user/event.rb:288-319Requirements
- Requires an existing Meterpreter session on the target.
modules/exploits/windows/persistence/service_for_user/event.rb:42 - Target user must have 'Logon as a batch job' privilege (SeBatchLogonRight).
modules/exploits/windows/persistence/service_for_user/event.rb:28 - Target must be Windows Vista/2008 or later.
modules/exploits/windows/persistence/service_for_user/event.rb:89
Observed behavior
- Generates a payload executable and uploads it to a writable directory on the target.
modules/exploits/windows/persistence/service_for_user/event.rb:293-303 - Creates an XML task definition with an event trigger that executes the uploaded payload when a specified Event ID is logged.
modules/exploits/windows/persistence/service_for_user/event.rb:170-181 - Installs the scheduled task using schtasks /create with the generated XML.
modules/exploits/windows/persistence/service_for_user/event.rb:258 - Registers cleanup commands to delete the task and payload file.
modules/exploits/windows/persistence/service_for_user/event.rb:263-264
Behaviors behind the backdoor verdict
Observables
- Payload Execution
- generate_payload_exeThe module generates and uploads a payload executable, which is standard for Metasploit persistence modules.
modules/exploits/windows/persistence/service_for_user/event.rb:294 - Scheduled Task Creation
- schtasks /create /xmlThe module creates a scheduled task using schtasks and an XML file, a common persistence technique.
modules/exploits/windows/persistence/service_for_user/event.rb:258 - Cleanup Commands
- schtasks /delete and rm commandsThe module registers cleanup commands to remove the task and payload, which is normal for Metasploit persistence modules.
modules/exploits/windows/persistence/service_for_user/event.rb:263-264
What the analysis did not establish
- Analysis based solely on module source code and metadata; framework mixins, libraries, and external payloads are not included.
- No runtime behavior or target interaction was observed; classification relies on static code intent.
- Only the module source code was reviewed; framework mixins, libraries, and external payloads are not expanded and could contain unrelated behavior.
- Binary files were not inspected (none present in this evidence).
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
Linked vulnerabilities
0This PoC is retained in the catalog but is not currently linked to a vulnerability.