{
  "name": "taskScheduler",
  "display_name": "taskScheduler",
  "kind": "module",
  "description": "Create and optionally run a scheduled task on a local or remote Windows host.",
  "command_template": "taskScheduler [--vault {vault:q}] -c {c:q} [-s {s:q}] [-t {t:q}] [-a {a:q}] [-u {u:q}] [-p {p:q}] [--no-run {no_run:flag}] [--nocleanup {nocleanup:flag}]",
  "target": "beacon",
  "requires_session": true,
  "platforms": ["windows"],
  "archs": ["x86", "x64", "arm64"],
  "args": [
    {
      "name": "--vault",
      "type": "credential",
      "required": false,
      "description": "TeamServer vault credential reference. The TeamServer resolves it to -u DOMAIN\\user -p password before dispatch.",
      "credential_filter": {
        "type": "password"
      }
    },
    {
      "name": "-c",
      "type": "flag",
      "required": true,
      "description": "Executable or command to run in the scheduled task."
    },
    {
      "name": "-s",
      "type": "flag",
      "required": false,
      "description": "Target host. Omit for localhost."
    },
    {
      "name": "-t",
      "type": "flag",
      "required": false,
      "description": "Scheduled task name. A random name is used if omitted."
    },
    {
      "name": "-a",
      "type": "flag",
      "required": false,
      "description": "Command line arguments."
    },
    {
      "name": "-u",
      "type": "flag",
      "required": false,
      "description": "DOMAIN\\user for explicit task registration credentials."
    },
    {
      "name": "-p",
      "type": "flag",
      "required": false,
      "description": "Password for the provided user."
    },
    {
      "name": "--no-run",
      "type": "flag",
      "required": false,
      "description": "Register the task without running it."
    },
    {
      "name": "--nocleanup",
      "type": "flag",
      "required": false,
      "description": "Keep the task after it starts."
    }
  ],
  "examples": [
    "taskScheduler --vault cred:credentialId -s HOST -c C:\\Windows\\System32\\cmd.exe -a \"/c whoami\"",
    "taskScheduler -c C:\\Windows\\System32\\cmd.exe -a \"/c whoami\"",
    "taskScheduler -s HOST -t UpdateTask -c C:\\Windows\\System32\\cmd.exe -a \"/c whoami\" --nocleanup"
  ],
  "source": "manifest"
}