miunasu/shadowscheduler

ShadowScheduler is a proof-of-concept tool demonstrating a covert Windows persistence technique that uses an undocumented internal scheduling interface called WP TaskScheduler. It shows how a scheduled task can be registered to run at user login while remaining completely invisible to every standard enumeration tool Windows administrators rely on. The technique works by calling an undocumented RPC interface (WPTaskScheduler.dll) that Windows 10 introduced internally for push notification scheduling. Tasks registered through this interface bypass the normal paths that tools like schtasks, Get-ScheduledTask, and the Task Scheduler management console depend on. The task does not appear in the TaskCache registry keys, is not written to the System32/Tasks folder, and does not show up in roughly 15 enumeration methods the README's comparison table covers. Even Autoruns, a widely trusted tool for finding persistent software, returns nothing. The task data is stored only in a specific registry path under CurrentVersion\Schedule\WP\TaskScheduler\Schedules, which standard tools do not check. This means the persistence survives reboots and remains active until explicitly removed through the same undocumented interface or by editing that registry key directly. Two implementations are provided. The first (raw_ndr64) manually constructs the NDR64 wire format and calls the RPC function directly, with no external dependencies beyond ntdll and rpcrt4. This makes it suitable as a shellcode building block or position-independent payload. The second (midl_poc) uses MIDL-generated client stub code, which is easier to read and modify but requires the generated stub files. Both compile with MSVC on Windows. The project is written in C and includes an IDL file that documents the interface format as reverse-engineered from real malware samples. The README is in Chinese, with an English version in a separate file. The disclaimer states it is for security research and education only, to help defenders understand and detect this class of persistence mechanism.