A city scheduled task runs elevated and points at a script the low-privilege user can modify. What should the tester conclude?
Select an answer to reveal the explanation.
Short Explanation
An elevated scheduled task with a writable script is a timed elevator you control. When the clock hits, higher privileges run your edited file—classic and high value. Name does not matter; the rights and the ACL do.
Full Explanation
A city scheduled task that runs elevated while pointing at a script the low-privilege user can modify is a high-value Windows privilege-escalation finding: elevated task execution will run attacker-controlled content under the task's privileged context when the weak file ACL is abused.
Scheduled tasks can and do run with higher rights than the editing user—that is why ACLs matter. Abuse is not limited to tasks named Adobe Update. The finding is not Linux-cron-only and must not be closed as N/A on Windows.
Exam caveat: review task principal, triggers, and the full writable path chain including include files.
Operational check: enumerate elevated tasks, verify script ACLs for non-privileged write, capture evidence, and recommend locking task payloads to privileged-only writable locations on municipal endpoints. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same finding class still applies under the estate's current patch and configuration baseline. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services.