AutoRuns icon indicating copy to clipboard operation
AutoRuns copied to clipboard

Scheduled task msiexec issue

Open p0w3rsh3ll opened this issue 1 year ago • 1 comments

Steps to reproduce

Get-PSAutorun -ScheduledTasks | ? { -not($_.Version) } | ogv -PassThru

Expected behavior

TBD

Actual behavior

Path          : C:\Windows\system32\Tasks\fake name
Item          : fake name
Category      : Task
Value         : msiexec /x{AABBCCDD-EEFF-AABB-CCDD-FEFFFFFFFFFF} /qn /norestart
ImagePath     : msiexec /x{AABBCCDD-EEFF-AABB-CCDD-FEFFFFFFFFFF} /qn /norestart

Environment data

> $PSVersionTable

p0w3rsh3ll avatar Jan 23 '24 10:01 p0w3rsh3ll

Won't fix. It's the purpose of the module. It aims at identifying what's beyond normal. In this case, it could have uninstalled a MSI based product. Worse, it could have been in the form of msiexec /i http://

p0w3rsh3ll avatar Jan 27 '24 10:01 p0w3rsh3ll