Impacket atexec

atexec.py <domain>/<user>:'<pass>'@<target> "<command>"

Executes a command on a remote Windows host by creating a temporary scheduled task (via the Windows Task Scheduler API).

When you need to execute a one-off command on a remote host from Linux without opening an interactive shell. atexec creates a task, executes it immediately, and deletes it, returning the output. Useful in environments where WMI is blocked but SMB and Task Scheduler (RPC) are functional.

If you need an interactive shell (atexec runs a single command and exits) or if the host does not expose the Task Scheduler RPC. In highly monitored environments, the creation of temporary tasks (4698) is visible.