T06 · System Persistence
Error
- Location
SKILL.md:48- Finding
Elevated Logon Persistence Executes a Mutable User-Profile Script
- Content
View full analysis
nul REM Create corrected task (runs at logon, no idle kill) schtasks /create /tn "OpenClaw Gateway" /tr "cmd /c cd /d \"%USERPROFILE%\.openclaw\" && gateway.cmd" /sc ONLOGON /rl HIGHEST /f ``` ### Technical Analysis The documented batch commands forcibly delete the existing `OpenClaw Gateway` scheduled task and recreate it with an `ONLOGON` trigger and the `HIGHEST` run level. This establishes execution that persists across sessions and requests the highest privileges available to the task principal. The task launches `gateway.cmd` indirectly through `cmd.exe` from `%USERPROFILE%\.openclaw`. The documentation does not validate the script's owner, access-control list, signature, or hash. Because a user-profile location is commonly writable by the account and potentially by processes operating under that account, any actor able to replace or alter `gateway.cmd` can influence what the scheduled task executes at the next logon. This design exceeds the minimum privileges necessary for the declared purpose. Correcting idle termination only requires changing the existing task's idle-related settings. It does not inherently require deleting the task, introducing a new logon trigger, requesting the highest run level, or launching a mutable batch file through a command interpreter. Forced replacement also discards the existing task definition, including its principal, action, conditions, access controls, failure behavior, and other security settings. The documentation claims that the replacement restarts on failure and operates regardless of battery state, but the provided `schtasks /create` command does not explicitly configure those properties. ### Attack Path ...[truncated 1931 chars]- Remediation
View remediation