Added tsch module

8 files changed, 555 insertions, 107 deletions

diff --git a/pkg/client/dcerpc/dcerpc.go b/pkg/client/dcerpc/dcerpc.go
index a22bff7..b2e53bd 100644
--- a/pkg/client/dcerpc/dcerpc.go
+++ b/pkg/client/dcerpc/dcerpc.go
@@ -65,6 +65,10 @@ func (client *DCEClient) OpenSvcctl(ctx context.Context) (ctl svcctl.SvcctlClien
 	return
 }
 
+func (client *DCEClient) DCE() dcerpc.Conn {
+	return client.conn
+}
+
 func (client *DCEClient) Connect(ctx context.Context, creds *adauth.Credential, target *adauth.Target, dialOpts ...dcerpc.Option) (err error) {
 	if creds != nil && target != nil {
 		authCtx := gssapi.NewSecurityContext(ctx)
diff --git a/pkg/exec/exec.go b/pkg/exec/exec.go
index 6e18378..91bc065 100644
--- a/pkg/exec/exec.go
+++ b/pkg/exec/exec.go
@@ -5,6 +5,11 @@ import (
 	"github.com/bryanmcnulty/adauth"
 )
 
+type CleanupConfig struct {
+	CleanupMethod       string
+	CleanupMethodConfig interface{}
+}
+
 type ExecutionConfig struct {
 	ExecutableName string // ExecutableName represents the name of the executable; i.e. "notepad.exe", "calc"
 	ExecutablePath string // ExecutablePath represents the full path to the executable; i.e. `C:\Windows\explorer.exe`
@@ -21,9 +26,10 @@ type ShellConfig struct {
 	ShellPath string // ShellPath is the full Windows path to the shell executable; i.e. `C:\Windows\System32\cmd.exe`
 }
 
-type Executor interface {
+type Module interface {
 	// Exec performs a single execution task without the need to call Init.
-	Exec(ctx context.Context, creds *adauth.Credential, target *adauth.Target, config *ExecutionConfig)
+	Exec(context.Context, *adauth.Credential, *adauth.Target, *ExecutionConfig) error
+	Cleanup(context.Context, *adauth.Credential, *adauth.Target, *CleanupConfig) error
 
 	// Init assigns the provided TODO
 	//Init(ctx context.Context, creds *adauth.Credential, target *adauth.Target)
diff --git a/pkg/exec/scmr/exec.go b/pkg/exec/scmr/exec.go
index b3c1531..c2702a3 100644
--- a/pkg/exec/scmr/exec.go
+++ b/pkg/exec/scmr/exec.go
@@ -4,11 +4,11 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"github.com/bryanmcnulty/adauth"
-	"github.com/rs/zerolog"
 	"github.com/FalconOpsLLC/goexec/pkg/client/dcerpc"
 	"github.com/FalconOpsLLC/goexec/pkg/exec"
 	"github.com/FalconOpsLLC/goexec/pkg/windows"
+	"github.com/bryanmcnulty/adauth"
+	"github.com/rs/zerolog"
 )
 
 const (
@@ -20,94 +20,94 @@ const (
 	ServiceAllAccess    uint32 = ServiceCreateAccess | ServiceModifyAccess
 )
 
-func (executor *Executor) createClients(ctx context.Context) (cleanup func(cCtx context.Context), err error) {
+func (mod *Module) createClients(ctx context.Context) (cleanup func(cCtx context.Context), err error) {
 
 	cleanup = func(context.Context) {
-		if executor.dce != nil {
-			executor.log.Debug().Msg("Cleaning up clients")
-			if err := executor.dce.Close(ctx); err != nil {
-				executor.log.Error().Err(err).Msg("Failed to destroy DCE connection")
+		if mod.dce != nil {
+			mod.log.Debug().Msg("Cleaning up clients")
+			if err := mod.dce.Close(ctx); err != nil {
+				mod.log.Error().Err(err).Msg("Failed to destroy DCE connection")
 			}
 		}
 	}
 	cleanup(ctx)
-	executor.dce = dcerpc.NewDCEClient(ctx, false, &dcerpc.SmbConfig{Port: 445})
+	mod.dce = dcerpc.NewDCEClient(ctx, false, &dcerpc.SmbConfig{Port: 445})
 	cleanup = func(context.Context) {}
 
-	if err = executor.dce.Connect(ctx, executor.creds, executor.target); err != nil {
+	if err = mod.dce.Connect(ctx, mod.creds, mod.target); err != nil {
 		return nil, fmt.Errorf("connection to DCERPC failed: %w", err)
 	}
-	executor.ctl, err = executor.dce.OpenSvcctl(ctx)
+	mod.ctl, err = mod.dce.OpenSvcctl(ctx)
 	return
 }
 
-func (executor *Executor) Exec(ctx context.Context, creds *adauth.Credential, target *adauth.Target, ecfg *exec.ExecutionConfig) (err error) {
+func (mod *Module) Exec(ctx context.Context, creds *adauth.Credential, target *adauth.Target, ecfg *exec.ExecutionConfig) (err error) {
 
 	vctx := context.WithoutCancel(ctx)
-	executor.log = zerolog.Ctx(ctx).With().
+	mod.log = zerolog.Ctx(ctx).With().
 		Str("module", "scmr").
 		Str("method", ecfg.ExecutionMethod).Logger()
-	executor.creds = creds
-	executor.target = target
+	mod.creds = creds
+	mod.target = target
 
 	if ecfg.ExecutionMethod == MethodCreate {
 		if cfg, ok := ecfg.ExecutionMethodConfig.(MethodCreateConfig); !ok || cfg.ServiceName == "" {
 			return errors.New("invalid configuration")
 		} else {
-			if cleanup, err := executor.createClients(ctx); err != nil {
+			if cleanup, err := mod.createClients(ctx); err != nil {
 				return fmt.Errorf("failed to create client: %w", err)
 			} else {
-				executor.log.Debug().Msg("Created clients")
+				mod.log.Debug().Msg("Created clients")
 				defer cleanup(ctx)
 			}
 			svc := &service{
 				createConfig: &cfg,
 				name:         cfg.ServiceName,
 			}
-			scm, code, err := executor.openSCM(ctx)
+			scm, code, err := mod.openSCM(ctx)
 			if err != nil {
 				return fmt.Errorf("failed to open SCM with code %d: %w", code, err)
 			}
-			executor.log.Debug().Msg("Opened handle to SCM")
-			code, err = executor.createService(ctx, scm, svc, ecfg)
+			mod.log.Debug().Msg("Opened handle to SCM")
+			code, err = mod.createService(ctx, scm, svc, ecfg)
 			if err != nil {
 				return fmt.Errorf("failed to create service with code %d: %w", code, err)
 			}
-			executor.log.Info().Str("service", svc.name).Msg("Service created")
+			mod.log.Info().Str("service", svc.name).Msg("Service created")
 			// From here on out, make sure the service is properly deleted, even if the connection drops or something fails.
 			if !cfg.NoDelete {
 				defer func() {
 					// TODO: stop service?
-					if code, err = executor.deleteService(ctx, scm, svc); err != nil {
-						executor.log.Error().Err(err).Msg("Failed to delete service") // TODO
+					if code, err = mod.deleteService(ctx, scm, svc); err != nil {
+						mod.log.Error().Err(err).Msg("Failed to delete service") // TODO
 					}
-					executor.log.Info().Str("service", svc.name).Msg("Service deleted successfully")
+					mod.log.Info().Str("service", svc.name).Msg("Service deleted successfully")
 				}()
 			}
-			if code, err = executor.startService(ctx, scm, svc); err != nil {
+			if code, err = mod.startService(ctx, scm, svc); err != nil {
 				if errors.Is(err, context.DeadlineExceeded) || errors.Is(err, context.Canceled) {
 					// In case of timeout or cancel, try to reestablish a connection to restore the service
-					executor.log.Info().Msg("Service start timeout/cancelled. Execution likely successful")
-					executor.log.Info().Msg("Reconnecting for cleanup procedure")
+					mod.log.Info().Msg("Service start timeout/cancelled. Execution likely successful")
+					mod.log.Info().Msg("Reconnecting for cleanup procedure")
 					ctx = vctx
 
-					if _, err = executor.createClients(ctx); err != nil {
-						executor.log.Error().Err(err).Msg("Reconnect failed")
+					if _, err = mod.createClients(ctx); err != nil {
+						mod.log.Error().Err(err).Msg("Reconnect failed")
 
-					} else if scm, code, err = executor.openSCM(ctx); err != nil {
-						executor.log.Error().Err(err).Msg("Failed to reopen SCM")
+					} else if scm, code, err = mod.openSCM(ctx); err != nil {
+						mod.log.Error().Err(err).Msg("Failed to reopen SCM")
 
-					} else if svc.handle, code, err = executor.openService(ctx, scm, svc.name); err != nil {
-						executor.log.Error().Str("service", svc.name).Err(err).Msg("Failed to reopen service handle")
+					} else if svc.handle, code, err = mod.openService(ctx, scm, svc.name); err != nil {
+						mod.log.Error().Str("service", svc.name).Err(err).Msg("Failed to reopen service handle")
 
 					} else {
-						executor.log.Debug().Str("service", svc.name).Msg("Reconnection successful")
+						mod.log.Debug().Str("service", svc.name).Msg("Reconnection successful")
 					}
 				} else {
-					executor.log.Error().Err(err).Msg("Failed to start service")
+					mod.log.Error().Err(err).Msg("Failed to start service")
 				}
 			} else {
-				executor.log.Info().Str("service", svc.name).Msg("Execution successful")
+				mod.log.Info().Str("service", svc.name).Msg("Execution successful")
 			}
 		}
 	} else if ecfg.ExecutionMethod == MethodModify {
@@ -123,102 +123,104 @@ func (executor *Executor) Exec(ctx context.Context, creds *adauth.Credential, ta
 			}
 
 			// Initialize protocol clients
-			if cleanup, err := executor.createClients(ctx); err != nil {
+			if cleanup, err := mod.createClients(ctx); err != nil {
 				return fmt.Errorf("failed to create client: %w", err)
 			} else {
-				executor.log.Debug().Msg("Created clients")
+				mod.log.Debug().Msg("Created clients")
 				defer cleanup(ctx)
 			}
 			svc := &service{modifyConfig: &cfg, name: cfg.ServiceName}
 
 			// Open SCM handle
-			scm, code, err := executor.openSCM(ctx)
+			scm, code, err := mod.openSCM(ctx)
 			if err != nil {
 				return fmt.Errorf("failed to create service with code %d: %w", code, err)
 			}
-			executor.log.Debug().Msg("Opened handle to SCM")
+			mod.log.Debug().Msg("Opened handle to SCM")
 
 			// Open service handle
-			if svc.handle, code, err = executor.openService(ctx, scm, svc.name); err != nil {
+			if svc.handle, code, err = mod.openService(ctx, scm, svc.name); err != nil {
 				return fmt.Errorf("failed to open service with code %d: %w", code, err)
 			}
-			executor.log.Debug().Str("service", svc.name).Msg("Opened service")
+			mod.log.Debug().Str("service", svc.name).Msg("Opened service")
 
 			// Stop service before editing
 			if !cfg.NoStart {
-				if code, err = executor.stopService(ctx, scm, svc); err != nil {
-					executor.log.Warn().Err(err).Msg("Failed to stop existing service")
+				if code, err = mod.stopService(ctx, scm, svc); err != nil {
+					mod.log.Warn().Err(err).Msg("Failed to stop existing service")
 				} else if code == windows.ERROR_SERVICE_NOT_ACTIVE {
-					executor.log.Debug().Str("service", svc.name).Msg("Service is not running")
+					mod.log.Debug().Str("service", svc.name).Msg("Service is not running")
 				} else {
-					executor.log.Info().Str("service", svc.name).Msg("Stopped existing service")
+					mod.log.Info().Str("service", svc.name).Msg("Stopped existing service")
 					defer func() {
-						if code, err = executor.startService(ctx, scm, svc); err != nil {
-							executor.log.Error().Err(err).Msg("Failed to restore service state to running")
+						if code, err = mod.startService(ctx, scm, svc); err != nil {
+							mod.log.Error().Err(err).Msg("Failed to restore service state to running")
 						}
 					}()
 				}
 			}
-			if code, err = executor.queryServiceConfig(ctx, svc); err != nil {
+			if code, err = mod.queryServiceConfig(ctx, svc); err != nil {
 				return fmt.Errorf("failed to query service configuration with code %d: %w", code, err)
 			}
-			executor.log.Debug().
+			mod.log.Debug().
 				Str("service", svc.name).
 				Str("command", svc.svcConfig.BinaryPathName).Msg("Fetched existing service configuration")
 
 			// Change service configuration
-			if code, err = executor.changeServiceConfigBinary(ctx, svc, cmd); err != nil {
+			if code, err = mod.changeServiceConfigBinary(ctx, svc, cmd); err != nil {
 				return fmt.Errorf("failed to edit service configuration with code %d: %w", code, err)
 			}
 			defer func() {
 				// Revert configuration
-				if code, err = executor.changeServiceConfigBinary(ctx, svc, svc.svcConfig.BinaryPathName); err != nil {
-					executor.log.Error().Err(err).Msg("Failed to restore service configuration")
+				if code, err = mod.changeServiceConfigBinary(ctx, svc, svc.svcConfig.BinaryPathName); err != nil {
+					mod.log.Error().Err(err).Msg("Failed to restore service configuration")
 				} else {
-					executor.log.Info().Str("service", svc.name).Msg("Restored service configuration")
+					mod.log.Info().Str("service", svc.name).Msg("Restored service configuration")
 				}
 			}()
-			executor.log.Info().
+			mod.log.Info().
 				Str("service", svc.name).
 				Str("command", cmd).Msg("Changed service configuration")
 
 			// Start service
 			if !cfg.NoStart {
-				if code, err = executor.startService(ctx, scm, svc); err != nil {
+				if code, err = mod.startService(ctx, scm, svc); err != nil {
 					if errors.Is(err, context.DeadlineExceeded) || errors.Is(err, context.Canceled) {
 						// In case of timeout or cancel, try to reestablish a connection to restore the service
-						executor.log.Info().Msg("Service start timeout/cancelled. Execution likely successful")
-						executor.log.Info().Msg("Reconnecting for cleanup procedure")
+						mod.log.Info().Msg("Service start timeout/cancelled. Execution likely successful")
+						mod.log.Info().Msg("Reconnecting for cleanup procedure")
 						ctx = vctx
 
-						if _, err = executor.createClients(ctx); err != nil {
-							executor.log.Error().Err(err).Msg("Reconnect failed")
+						if _, err = mod.createClients(ctx); err != nil {
+							mod.log.Error().Err(err).Msg("Reconnect failed")
 
-						} else if scm, code, err = executor.openSCM(ctx); err != nil {
-							executor.log.Error().Err(err).Msg("Failed to reopen SCM")
+						} else if scm, code, err = mod.openSCM(ctx); err != nil {
+							mod.log.Error().Err(err).Msg("Failed to reopen SCM")
 
-						} else if svc.handle, code, err = executor.openService(ctx, scm, svc.name); err != nil {
-							executor.log.Error().Str("service", svc.name).Err(err).Msg("Failed to reopen service handle")
+						} else if svc.handle, code, err = mod.openService(ctx, scm, svc.name); err != nil {
+							mod.log.Error().Str("service", svc.name).Err(err).Msg("Failed to reopen service handle")
 
 						} else {
-							executor.log.Debug().Str("service", svc.name).Msg("Reconnection successful")
+							mod.log.Debug().Str("service", svc.name).Msg("Reconnection successful")
 						}
 					} else {
-						executor.log.Error().Err(err).Msg("Failed to start service")
+						mod.log.Error().Err(err).Msg("Failed to start service")
 					}
 				} else {
-					executor.log.Info().Str("service", svc.name).Msg("Started service")
+					mod.log.Info().Str("service", svc.name).Msg("Started service")
 				}
 				defer func() {
 					// Stop service
-					if code, err = executor.stopService(ctx, scm, svc); err != nil {
-						executor.log.Error().Err(err).Msg("Failed to stop service")
+					if code, err = mod.stopService(ctx, scm, svc); err != nil {
+						mod.log.Error().Err(err).Msg("Failed to stop service")
 					} else {
-						executor.log.Info().Str("service", svc.name).Msg("Stopped service")
+						mod.log.Info().Str("service", svc.name).Msg("Stopped service")
 					}
 				}()
 			}
 		}
+	} else {
+		return fmt.Errorf("invalid method: %s", ecfg.ExecutionMethod)
 	}
 	return err
 }
diff --git a/pkg/exec/scmr/module.go b/pkg/exec/scmr/module.go
index 1c855fb..b35c746 100644
--- a/pkg/exec/scmr/module.go
+++ b/pkg/exec/scmr/module.go
@@ -1,13 +1,13 @@
 package scmrexec
 
 import (
+	"github.com/FalconOpsLLC/goexec/pkg/client/dcerpc"
 	"github.com/bryanmcnulty/adauth"
 	"github.com/oiweiwei/go-msrpc/msrpc/scmr/svcctl/v2"
 	"github.com/rs/zerolog"
-	"github.com/FalconOpsLLC/goexec/pkg/client/dcerpc"
 )
 
-type Executor struct {
+type Module struct {
 	creds    *adauth.Credential
 	target   *adauth.Target
 	hostname string
diff --git a/pkg/exec/scmr/scmr.go b/pkg/exec/scmr/scmr.go
index fbbb108..e9ef53f 100644
--- a/pkg/exec/scmr/scmr.go
+++ b/pkg/exec/scmr/scmr.go
@@ -4,10 +4,10 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"github.com/oiweiwei/go-msrpc/msrpc/scmr/svcctl/v2"
 	"github.com/FalconOpsLLC/goexec/internal/util"
 	"github.com/FalconOpsLLC/goexec/pkg/exec"
 	"github.com/FalconOpsLLC/goexec/pkg/windows"
+	"github.com/oiweiwei/go-msrpc/msrpc/scmr/svcctl/v2"
 )
 
 type service struct {
@@ -23,14 +23,14 @@ type service struct {
 
 // openSCM opens a handle to SCM via ROpenSCManagerW
 // https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/dc84adb3-d51d-48eb-820d-ba1c6ca5faf2
-func (executor *Executor) openSCM(ctx context.Context) (scm *svcctl.Handle, code uint32, err error) {
-	if executor.ctl != nil {
+func (mod *Module) openSCM(ctx context.Context) (scm *svcctl.Handle, code uint32, err error) {
+	if mod.ctl != nil {
 
-		hostname := executor.hostname
+		hostname := mod.hostname
 		if hostname == "" {
 			hostname = util.RandomHostname()
 		}
-		if response, err := executor.ctl.OpenSCMW(ctx, &svcctl.OpenSCMWRequest{
+		if response, err := mod.ctl.OpenSCMW(ctx, &svcctl.OpenSCMWRequest{
 			MachineName:   hostname + "\x00",    // lpMachineName; The server's name (i.e. DC01, dc01.domain.local)
 			DatabaseName:  "ServicesActive\x00", // lpDatabaseName; must be "ServicesActive" or "ServicesFailed"
 			DesiredAccess: ServiceModifyAccess,  // dwDesiredAccess; requested access - appears to be ignored?
@@ -49,10 +49,10 @@ func (executor *Executor) openSCM(ctx context.Context) (scm *svcctl.Handle, code
 
 // createService creates a service with the provided configuration via RCreateServiceW
 // https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/6a8ca926-9477-4dd4-b766-692fab07227e
-func (executor *Executor) createService(ctx context.Context, scm *svcctl.Handle, scfg *service, ecfg *exec.ExecutionConfig) (code uint32, err error) {
-	if executor.ctl != nil && scm != nil && scfg != nil && scfg.createConfig != nil {
+func (mod *Module) createService(ctx context.Context, scm *svcctl.Handle, scfg *service, ecfg *exec.ExecutionConfig) (code uint32, err error) {
+	if mod.ctl != nil && scm != nil && scfg != nil && scfg.createConfig != nil {
 		cfg := scfg.createConfig
-		if response, err := executor.ctl.CreateServiceW(ctx, &svcctl.CreateServiceWRequest{
+		if response, err := mod.ctl.CreateServiceW(ctx, &svcctl.CreateServiceWRequest{
 			ServiceManager: scm,
 			ServiceName:    cfg.ServiceName + "\x00",
 			DisplayName:    cfg.DisplayName + "\x00",
@@ -76,9 +76,9 @@ func (executor *Executor) createService(ctx context.Context, scm *svcctl.Handle,
 
 // openService opens a handle to a service given the service name (lpServiceName)
 // https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/6d0a4225-451b-4132-894d-7cef7aecfd2d
-func (executor *Executor) openService(ctx context.Context, scm *svcctl.Handle, svcName string) (*svcctl.Handle, uint32, error) {
-	if executor.ctl != nil && scm != nil {
-		if openResponse, err := executor.ctl.OpenServiceW(ctx, &svcctl.OpenServiceWRequest{
+func (mod *Module) openService(ctx context.Context, scm *svcctl.Handle, svcName string) (*svcctl.Handle, uint32, error) {
+	if mod.ctl != nil && scm != nil {
+		if openResponse, err := mod.ctl.OpenServiceW(ctx, &svcctl.OpenServiceWRequest{
 			ServiceManager: scm,
 			ServiceName:    svcName,
 			DesiredAccess:  ServiceAllAccess,
@@ -99,9 +99,9 @@ func (executor *Executor) openService(ctx context.Context, scm *svcctl.Handle, s
 
 // deleteService deletes an existing service with RDeleteService
 // https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/6744cdb8-f162-4be0-bb31-98996b6495be
-func (executor *Executor) deleteService(ctx context.Context, scm *svcctl.Handle, svc *service) (code uint32, err error) {
-	if executor.ctl != nil && scm != nil && svc != nil {
-		if deleteResponse, err := executor.ctl.DeleteService(ctx, &svcctl.DeleteServiceRequest{Service: svc.handle}); err != nil {
+func (mod *Module) deleteService(ctx context.Context, scm *svcctl.Handle, svc *service) (code uint32, err error) {
+	if mod.ctl != nil && scm != nil && svc != nil {
+		if deleteResponse, err := mod.ctl.DeleteService(ctx, &svcctl.DeleteServiceRequest{Service: svc.handle}); err != nil {
 			defer func() {}()
 			if deleteResponse != nil {
 				return deleteResponse.Return, fmt.Errorf("delete service response: %w", err)
@@ -115,9 +115,9 @@ func (executor *Executor) deleteService(ctx context.Context, scm *svcctl.Handle,
 
 // controlService sets the state of the provided process
 // https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/e1c478be-117f-4512-9b67-17c20a48af97
-func (executor *Executor) controlService(ctx context.Context, scm *svcctl.Handle, svc *service, control uint32) (code uint32, err error) {
-	if executor.ctl != nil && scm != nil && svc != nil {
-		if controlResponse, err := executor.ctl.ControlService(ctx, &svcctl.ControlServiceRequest{
+func (mod *Module) controlService(ctx context.Context, scm *svcctl.Handle, svc *service, control uint32) (code uint32, err error) {
+	if mod.ctl != nil && scm != nil && svc != nil {
+		if controlResponse, err := mod.ctl.ControlService(ctx, &svcctl.ControlServiceRequest{
 			Service: svc.handle,
 			Control: control,
 		}); err != nil {
@@ -133,8 +133,8 @@ func (executor *Executor) controlService(ctx context.Context, scm *svcctl.Handle
 
 // stopService sends stop signal to existing service using controlService
 // https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/e1c478be-117f-4512-9b67-17c20a48af97
-func (executor *Executor) stopService(ctx context.Context, scm *svcctl.Handle, svc *service) (code uint32, err error) {
-	if code, err = executor.controlService(ctx, scm, svc, windows.SERVICE_CONTROL_STOP); code == windows.ERROR_SERVICE_NOT_ACTIVE {
+func (mod *Module) stopService(ctx context.Context, scm *svcctl.Handle, svc *service) (code uint32, err error) {
+	if code, err = mod.controlService(ctx, scm, svc, windows.SERVICE_CONTROL_STOP); code == windows.ERROR_SERVICE_NOT_ACTIVE {
 		err = nil
 	}
 	return
@@ -142,9 +142,9 @@ func (executor *Executor) stopService(ctx context.Context, scm *svcctl.Handle, s
 
 // startService starts the specified service with RStartServiceW
 // https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/d9be95a2-cf01-4bdc-b30f-6fe4b37ada16
-func (executor *Executor) startService(ctx context.Context, scm *svcctl.Handle, svc *service) (code uint32, err error) {
-	if executor.ctl != nil && scm != nil && svc != nil {
-		if startResponse, err := executor.ctl.StartServiceW(ctx, &svcctl.StartServiceWRequest{Service: svc.handle}); err != nil {
+func (mod *Module) startService(ctx context.Context, scm *svcctl.Handle, svc *service) (code uint32, err error) {
+	if mod.ctl != nil && scm != nil && svc != nil {
+		if startResponse, err := mod.ctl.StartServiceW(ctx, &svcctl.StartServiceWRequest{Service: svc.handle}); err != nil {
 			if startResponse != nil {
 				// TODO: check if service is already running, return nil error if so
 				if startResponse.Return == windows.ERROR_SERVICE_REQUEST_TIMEOUT {
@@ -161,9 +161,9 @@ func (executor *Executor) startService(ctx context.Context, scm *svcctl.Handle,
 
 // closeService closes the specified service handle using RCloseServiceHandle
 // https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/a2a4e174-09fb-4e55-bad3-f77c4b13245c
-func (executor *Executor) closeService(ctx context.Context, svc *svcctl.Handle) (code uint32, err error) {
-	if executor.ctl != nil && svc != nil {
-		if closeResponse, err := executor.ctl.CloseService(ctx, &svcctl.CloseServiceRequest{ServiceObject: svc}); err != nil {
+func (mod *Module) closeService(ctx context.Context, svc *svcctl.Handle) (code uint32, err error) {
+	if mod.ctl != nil && svc != nil {
+		if closeResponse, err := mod.ctl.CloseService(ctx, &svcctl.CloseServiceRequest{ServiceObject: svc}); err != nil {
 			if closeResponse != nil {
 				return closeResponse.Return, fmt.Errorf("close service response: %w", err)
 			}
@@ -176,9 +176,9 @@ func (executor *Executor) closeService(ctx context.Context, svc *svcctl.Handle)
 
 // getServiceConfig fetches the configuration details of a service given a handle passed in a service{} structure.
 // https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/89e2d5b1-19cf-44ca-969f-38eea9fe7f3c
-func (executor *Executor) queryServiceConfig(ctx context.Context, svc *service) (code uint32, err error) {
-	if executor.ctl != nil && svc != nil && svc.handle != nil {
-		if getResponse, err := executor.ctl.QueryServiceConfigW(ctx, &svcctl.QueryServiceConfigWRequest{
+func (mod *Module) queryServiceConfig(ctx context.Context, svc *service) (code uint32, err error) {
+	if mod.ctl != nil && svc != nil && svc.handle != nil {
+		if getResponse, err := mod.ctl.QueryServiceConfigW(ctx, &svcctl.QueryServiceConfigWRequest{
 			Service:      svc.handle,
 			BufferLength: 1024 * 8,
 		}); err != nil {
@@ -196,9 +196,9 @@ func (executor *Executor) queryServiceConfig(ctx context.Context, svc *service)
 
 // queryServiceStatus fetches the state of the specified service
 // https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/cf94d915-b4e1-40e5-872b-a9cb3ad09b46
-func (executor *Executor) queryServiceStatus(ctx context.Context, svc *service) (uint32, error) {
-	if executor.ctl != nil && svc != nil {
-		if queryResponse, err := executor.ctl.QueryServiceStatus(ctx, &svcctl.QueryServiceStatusRequest{Service: svc.handle}); err != nil {
+func (mod *Module) queryServiceStatus(ctx context.Context, svc *service) (uint32, error) {
+	if mod.ctl != nil && svc != nil {
+		if queryResponse, err := mod.ctl.QueryServiceStatus(ctx, &svcctl.QueryServiceStatusRequest{Service: svc.handle}); err != nil {
 			if queryResponse != nil {
 				return queryResponse.Return, fmt.Errorf("query service status response: %w", err)
 			}
@@ -213,9 +213,9 @@ func (executor *Executor) queryServiceStatus(ctx context.Context, svc *service)
 
 // changeServiceConfigBinary edits the provided service's lpBinaryPathName
 // https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/61ea7ed0-c49d-4152-a164-b4830f16c8a4
-func (executor *Executor) changeServiceConfigBinary(ctx context.Context, svc *service, bin string) (code uint32, err error) {
-	if executor.ctl != nil && svc != nil && svc.handle != nil {
-		if changeResponse, err := executor.ctl.ChangeServiceConfigW(ctx, &svcctl.ChangeServiceConfigWRequest{
+func (mod *Module) changeServiceConfigBinary(ctx context.Context, svc *service, bin string) (code uint32, err error) {
+	if mod.ctl != nil && svc != nil && svc.handle != nil {
+		if changeResponse, err := mod.ctl.ChangeServiceConfigW(ctx, &svcctl.ChangeServiceConfigWRequest{
 			Service:        svc.handle,
 			ServiceType:    svc.svcConfig.ServiceType,
 			StartType:      svc.svcConfig.StartType,
diff --git a/pkg/exec/tsch/exec.go b/pkg/exec/tsch/exec.go
new file mode 100644
index 0000000..030a016
--- /dev/null
+++ b/pkg/exec/tsch/exec.go
@@ -0,0 +1,278 @@
+package tschexec
+
+import (
+	"context"
+	"encoding/xml"
+	"errors"
+	"fmt"
+	"github.com/FalconOpsLLC/goexec/internal/util"
+	dce "github.com/FalconOpsLLC/goexec/pkg/client/dcerpc"
+	"github.com/FalconOpsLLC/goexec/pkg/exec"
+	"github.com/bryanmcnulty/adauth"
+	"github.com/oiweiwei/go-msrpc/dcerpc"
+	"github.com/oiweiwei/go-msrpc/msrpc/tsch/itaskschedulerservice/v1"
+	"github.com/rs/zerolog"
+	"regexp"
+	"time"
+)
+
+const (
+	TaskXMLDurationFormat = "2006-01-02T15:04:05.9999999Z"
+	TaskXMLHeader         = `<?xml version="1.0" encoding="UTF-16"?>`
+)
+
+var (
+	TaskPathRegex = regexp.MustCompile(`^\\[^ :/\\][^:/]*$`) // https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/fa8809c8-4f0f-4c6d-994a-6c10308757c1
+	TaskNameRegex = regexp.MustCompile(`^[^ :/\\][^:/\\]*$`)
+)
+
+// *very* simple implementation of xs:duration - only accepts +seconds
+func xmlDuration(dur time.Duration) string {
+	if s := int(dur.Seconds()); s >= 0 {
+		return fmt.Sprintf(`PT%dS`, s)
+	}
+	return `PT0S`
+}
+
+// Connect to the target & initialize DCE & TSCH clients
+func (mod *Module) Connect(ctx context.Context, creds *adauth.Credential, target *adauth.Target) (err error) {
+	if mod.dce == nil {
+		mod.dce = dce.NewDCEClient(ctx, false, &dce.SmbConfig{})
+		if err = mod.dce.Connect(ctx, creds, target); err != nil {
+			return fmt.Errorf("DCE connect: %w", err)
+		} else if mod.tsch, err = itaskschedulerservice.NewTaskSchedulerServiceClient(ctx, mod.dce.DCE(), dcerpc.WithSecurityLevel(dcerpc.AuthLevelPktPrivacy)); err != nil {
+			return fmt.Errorf("init MS-TSCH client: %w", err)
+		}
+		mod.log.Info().Msg("DCE connection successful")
+	}
+	return
+}
+
+func (mod *Module) Cleanup(ctx context.Context, creds *adauth.Credential, target *adauth.Target, ccfg *exec.CleanupConfig) (err error) {
+	mod.log = zerolog.Ctx(ctx).With().
+		Str("module", "tsch").
+		Str("method", ccfg.CleanupMethod).Logger()
+	mod.creds = creds
+	mod.target = target
+
+	if ccfg.CleanupMethod == MethodDelete {
+		if cfg, ok := ccfg.CleanupMethodConfig.(MethodDeleteConfig); !ok {
+			return errors.New("invalid configuration")
+		} else {
+			if err = mod.Connect(ctx, creds, target); err != nil {
+				return fmt.Errorf("connect: %w", err)
+			} else if _, err = mod.tsch.Delete(ctx, &itaskschedulerservice.DeleteRequest{
+				Path:  cfg.TaskPath,
+				Flags: 0,
+			}); err != nil {
+				mod.log.Error().Err(err).Str("task", cfg.TaskPath).Msg("Failed to delete task")
+				return fmt.Errorf("delete task: %w", err)
+			} else {
+				mod.log.Info().Str("task", cfg.TaskPath).Msg("Task deleted successfully")
+			}
+		}
+	} else {
+		return fmt.Errorf("method not implemented: %s", ccfg.CleanupMethod)
+	}
+	return
+}
+
+func (mod *Module) Exec(ctx context.Context, creds *adauth.Credential, target *adauth.Target, ecfg *exec.ExecutionConfig) (err error) {
+
+	mod.log = zerolog.Ctx(ctx).With().
+		Str("module", "tsch").
+		Str("method", ecfg.ExecutionMethod).Logger()
+	mod.creds = creds
+	mod.target = target
+
+	if ecfg.ExecutionMethod == MethodRegister {
+		if cfg, ok := ecfg.ExecutionMethodConfig.(MethodRegisterConfig); !ok {
+			return errors.New("invalid configuration")
+
+		} else {
+			startTime := time.Now().UTC().Add(cfg.StartDelay)
+			task := &task{
+				TaskVersion:   "1.2",                                                   // static
+				TaskNamespace: "http://schemas.microsoft.com/windows/2004/02/mit/task", // static
+				TimeTriggers: []taskTimeTrigger{
+					{
+						StartBoundary: startTime.Format(TaskXMLDurationFormat),
+						Enabled:       true,
+					},
+				},
+				Principals: defaultPrincipals,
+				Settings:   defaultSettings,
+				Actions:    actions{Context: defaultPrincipals.Principals[0].ID, Exec: []actionExec{{Command: ecfg.ExecutableName, Arguments: ecfg.ExecutableArgs}}},
+			}
+			if !cfg.NoDelete && !cfg.CallDelete {
+				if cfg.StopDelay == 0 {
+					// EndBoundary cannot be >= StartBoundary
+					cfg.StopDelay = 1 * time.Second
+				}
+				stopTime := startTime.Add(cfg.StopDelay)
+
+				mod.log.Info().Time("when", stopTime).Msg("Task is scheduled to delete")
+				task.Settings.DeleteExpiredTaskAfter = xmlDuration(cfg.DeleteDelay)
+				task.TimeTriggers[0].EndBoundary = stopTime.Format(TaskXMLDurationFormat)
+			}
+
+			if doc, err := xml.Marshal(task); err != nil {
+				return fmt.Errorf("marshal task XML: %w", err)
+
+			} else {
+				mod.log.Debug().Str("task", string(doc)).Msg("Task XML generated")
+				docStr := TaskXMLHeader + string(doc)
+
+				taskPath := cfg.TaskPath
+				taskName := cfg.TaskName
+
+				if taskName == "" {
+					taskName = util.RandomString()
+				}
+				if taskPath == "" {
+					taskPath = `\` + taskName
+				}
+
+				if err = mod.Connect(ctx, creds, target); err != nil {
+					return fmt.Errorf("connect: %w", err)
+				}
+				defer func() {
+					if err = mod.dce.Close(ctx); err != nil {
+						mod.log.Warn().Err(err).Msg("Failed to dispose dce client")
+					} else {
+						mod.log.Debug().Msg("Disposed DCE client")
+					}
+				}()
+				var response *itaskschedulerservice.RegisterTaskResponse
+				if response, err = mod.tsch.RegisterTask(ctx, &itaskschedulerservice.RegisterTaskRequest{
+					Path:       taskPath,
+					XML:        docStr,
+					Flags:      0, // TODO
+					LogonType:  0, // TASK_LOGON_NONE
+					CredsCount: 0,
+					Creds:      nil,
+				}); err != nil {
+					return err
+
+				} else {
+					mod.log.Info().Str("path", response.ActualPath).Msg("Task registered successfully")
+
+					if !cfg.NoDelete && cfg.CallDelete {
+						defer func() {
+							if err = mod.Cleanup(ctx, creds, target, &exec.CleanupConfig{
+								CleanupMethod:       MethodDelete,
+								CleanupMethodConfig: MethodDeleteConfig{TaskPath: taskPath},
+							}); err != nil {
+								mod.log.Error().Err(err).Msg("Failed to delete task")
+							}
+						}()
+						mod.log.Info().Dur("ms", cfg.StartDelay).Msg("Waiting for task to run")
+						select {
+						case <-ctx.Done():
+							mod.log.Warn().Msg("Cancelling execution")
+							return err
+						case <-time.After(cfg.StartDelay + (time.Second * 2)): // + two seconds
+							// TODO: check if task is running yet; delete if the wait period is over
+							break
+						}
+						return err
+					}
+				}
+			}
+		}
+	} else if ecfg.ExecutionMethod == MethodDemand {
+		if cfg, ok := ecfg.ExecutionMethodConfig.(MethodDemandConfig); !ok {
+			return errors.New("invalid configuration")
+
+		} else {
+			taskPath := cfg.TaskPath
+			taskName := cfg.TaskName
+
+			if taskName == "" {
+				mod.log.Debug().Msg("Task name not defined. Using random string")
+				taskName = util.RandomString()
+			}
+			if taskPath == "" {
+				taskPath = `\` + taskName
+			}
+			if !TaskNameRegex.MatchString(taskName) {
+				return fmt.Errorf("invalid task name: %s", taskName)
+			}
+			if !TaskPathRegex.MatchString(taskPath) {
+				return fmt.Errorf("invalid task path: %s", taskPath)
+			}
+
+			mod.log.Debug().Msg("Using demand method")
+			settings := defaultSettings
+			settings.AllowStartOnDemand = true
+			task := &task{
+				TaskVersion:   "1.2",                                                   // static
+				TaskNamespace: "http://schemas.microsoft.com/windows/2004/02/mit/task", // static
+				Principals:    defaultPrincipals,
+				Settings:      defaultSettings,
+				Actions: actions{
+					Context: defaultPrincipals.Principals[0].ID,
+					Exec: []actionExec{
+						{
+							Command:   ecfg.ExecutableName,
+							Arguments: ecfg.ExecutableArgs,
+						},
+					},
+				},
+			}
+			if doc, err := xml.Marshal(task); err != nil {
+				return fmt.Errorf("marshal task: %w", err)
+			} else {
+				docStr := TaskXMLHeader + string(doc)
+
+				if err = mod.Connect(ctx, creds, target); err != nil {
+					return fmt.Errorf("connect: %w", err)
+				}
+				defer func() {
+					if err = mod.dce.Close(ctx); err != nil {
+						mod.log.Warn().Err(err).Msg("Failed to dispose dce client")
+					} else {
+						mod.log.Debug().Msg("Disposed DCE client")
+					}
+				}()
+
+				var response *itaskschedulerservice.RegisterTaskResponse
+				if response, err = mod.tsch.RegisterTask(ctx, &itaskschedulerservice.RegisterTaskRequest{
+					Path:       taskPath,
+					XML:        docStr,
+					Flags:      0, // TODO
+					LogonType:  0, // TASK_LOGON_NONE
+					CredsCount: 0,
+					Creds:      nil,
+				}); err != nil {
+					return fmt.Errorf("register task: %w", err)
+
+				} else {
+					mod.log.Info().Str("task", response.ActualPath).Msg("Task registered successfully")
+					if !cfg.NoDelete {
+						defer func() {
+							if err = mod.Cleanup(ctx, creds, target, &exec.CleanupConfig{
+								CleanupMethod:       MethodDelete,
+								CleanupMethodConfig: MethodDeleteConfig{TaskPath: taskPath},
+							}); err != nil {
+								mod.log.Error().Err(err).Msg("Failed to delete task")
+							}
+						}()
+					}
+					if _, err = mod.tsch.Run(ctx, &itaskschedulerservice.RunRequest{
+						Path:  response.ActualPath,
+						Flags: 0, // Maybe we want to use these?
+					}); err != nil {
+						return err
+					} else {
+						mod.log.Info().Str("task", response.ActualPath).Msg("Started task")
+					}
+				}
+			}
+		}
+	} else {
+		return fmt.Errorf("method not implemented: %s", ecfg.ExecutionMethod)
+	}
+
+	return nil
+}
diff --git a/pkg/exec/tsch/module.go b/pkg/exec/tsch/module.go
new file mode 100644
index 0000000..3112902
--- /dev/null
+++ b/pkg/exec/tsch/module.go
@@ -0,0 +1,56 @@
+package tschexec
+
+import (
+	"context"
+	"github.com/FalconOpsLLC/goexec/pkg/client/dcerpc"
+	"github.com/bryanmcnulty/adauth"
+	"github.com/oiweiwei/go-msrpc/msrpc/tsch/itaskschedulerservice/v1"
+	"github.com/rs/zerolog"
+	"time"
+)
+
+type Step struct {
+	Name   string                                                      // Name of the step
+	Status string                                                      // Status indicates whether the task succeeded, failed, etc.
+	Call   func(context.Context, *Module, ...any) (interface{}, error) // Call will invoke the procedure
+	Match  func(context.Context, *Module, ...any) (bool, error)        // Match will make an assertion to determine whether the step was successful
+}
+
+type Module struct {
+	creds  *adauth.Credential
+	target *adauth.Target
+
+	log  zerolog.Logger
+	dce  *dcerpc.DCEClient
+	tsch itaskschedulerservice.TaskSchedulerServiceClient
+}
+
+type MethodRegisterConfig struct {
+	NoDelete    bool
+	CallDelete  bool
+	TaskName    string
+	TaskPath    string
+	StartDelay  time.Duration
+	StopDelay   time.Duration
+	DeleteDelay time.Duration
+}
+
+type MethodDemandConfig struct {
+	NoDelete    bool
+	CallDelete  bool
+	TaskName    string
+	TaskPath    string
+	StopDelay   time.Duration
+	DeleteDelay time.Duration
+}
+
+type MethodDeleteConfig struct {
+	TaskPath string
+}
+
+const (
+	MethodRegister string = "register"
+	MethodDemand   string = "demand"
+	MethodDelete   string = "delete"
+	MethodChange   string = "update"
+)
diff --git a/pkg/exec/tsch/tsch.go b/pkg/exec/tsch/tsch.go
new file mode 100644
index 0000000..bc3ed0b
--- /dev/null
+++ b/pkg/exec/tsch/tsch.go
@@ -0,0 +1,102 @@
+package tschexec
+
+import (
+	"encoding/xml"
+)
+
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/0d6383e4-de92-43e7-b0bb-a60cfa36379f
+
+type taskTimeTrigger struct {
+	XMLName       xml.Name `xml:"TimeTrigger"`
+	StartBoundary string   `xml:"StartBoundary,omitempty"` // Derived from time.Time
+	EndBoundary   string   `xml:"EndBoundary,omitempty"`   // Derived from time.Time; must be > StartBoundary
+	Enabled       bool     `xml:"Enabled"`
+}
+
+type idleSettings struct {
+	StopOnIdleEnd bool `xml:"StopOnIdleEnd"`
+	RestartOnIdle bool `xml:"RestartOnIdle"`
+}
+
+type settings struct {
+	XMLName                    xml.Name     `xml:"Settings"`
+	Enabled                    bool         `xml:"Enabled"`
+	Hidden                     bool         `xml:"Hidden"`
+	DisallowStartIfOnBatteries bool         `xml:"DisallowStartIfOnBatteries"`
+	StopIfGoingOnBatteries     bool         `xml:"StopIfGoingOnBatteries"`
+	AllowHardTerminate         bool         `xml:"AllowHardTerminate"`
+	RunOnlyIfNetworkAvailable  bool         `xml:"RunOnlyIfNetworkAvailable"`
+	AllowStartOnDemand         bool         `xml:"AllowStartOnDemand"`
+	WakeToRun                  bool         `xml:"WakeToRun"`
+	RunOnlyIfIdle              bool         `xml:"RunOnlyIfIdle"`
+	StartWhenAvailable         bool         `xml:"StartWhenAvailable"`
+	Priority                   int          `xml:"Priority,omitempty"` // 1 to 10 inclusive
+	MultipleInstancesPolicy    string       `xml:"MultipleInstancesPolicy,omitempty"`
+	ExecutionTimeLimit         string       `xml:"ExecutionTimeLimit,omitempty"`
+	DeleteExpiredTaskAfter     string       `xml:"DeleteExpiredTaskAfter,omitempty"` // Derived from time.Duration
+	IdleSettings               idleSettings `xml:"IdleSettings,omitempty"`
+}
+
+type actionExec struct {
+	XMLName   xml.Name `xml:"Exec"`
+	Command   string   `xml:"Command"`
+	Arguments string   `xml:"Arguments"`
+}
+
+type actions struct {
+	XMLName xml.Name     `xml:"Actions"`
+	Context string       `xml:"Context,attr"`
+	Exec    []actionExec `xml:"Exec,omitempty"`
+}
+
+type principals struct {
+	XMLName    xml.Name    `xml:"Principals"`
+	Principals []principal `xml:"Principal"`
+}
+
+type principal struct {
+	XMLName  xml.Name `xml:"Principal"`
+	ID       string   `xml:"id,attr"`
+	UserID   string   `xml:"UserId"`
+	RunLevel string   `xml:"RunLevel"`
+}
+
+type task struct {
+	XMLName       xml.Name          `xml:"Task"`
+	TaskVersion   string            `xml:"version,attr"`
+	TaskNamespace string            `xml:"xmlns,attr"`
+	TimeTriggers  []taskTimeTrigger `xml:"Triggers>TimeTrigger,omitempty"`
+	Actions       actions           `xml:"Actions"`
+	Principals    principals        `xml:"Principals"`
+	Settings      settings          `xml:"Settings"`
+}
+
+var (
+	defaultSettings = settings{
+		MultipleInstancesPolicy:    "IgnoreNew",
+		DisallowStartIfOnBatteries: false,
+		StopIfGoingOnBatteries:     false,
+		AllowHardTerminate:         true,
+		RunOnlyIfNetworkAvailable:  false,
+		IdleSettings: idleSettings{
+			StopOnIdleEnd: true,
+			RestartOnIdle: false,
+		},
+		AllowStartOnDemand: true,
+		Enabled:            true,
+		Hidden:             true,
+		RunOnlyIfIdle:      false,
+		WakeToRun:          false,
+		Priority:           7, // 7 is a pretty standard value for scheduled tasks
+		StartWhenAvailable: true,
+	}
+	defaultPrincipals = principals{
+		Principals: []principal{
+			{
+				ID:       "SYSTEM",
+				UserID:   "S-1-5-18",
+				RunLevel: "HighestAvailable",
+			},
+		},
+	}
+)