new-check(winpeas): add high-impact vulnerability detection

[carlospolop]

Automated proposal for one new, high-impact winpeas vulnerability-detection check.

Agent research and validation summary:
PEASS winpeas new-check agent completed successfully with 57 steps. Agent Comment: Implemented exactly one new winPEAS check: writable execution targets in enabled LocalSystem scheduled tasks.

Why it matters

Windows scheduled tasks can execute programs under the highly privileged LocalSystem account. MITRE classifies scheduled tasks as a privilege-escalation technique and specifically recommends auditing task permission weaknesses. Microsoft documents the SYSTEM execution context, while MITRE ATT&CK T1053.005 identifies permission weaknesses in scheduled tasks as escalation opportunities.

Detection behavior

The passive check:

• Enumerates enabled tasks whose principal is LocalSystem/SYSTEM.
• Examines ExecAction.Path, Arguments, and WorkingDirectory, as defined by the Microsoft ExecAction API.
• Detects writable executables and referenced scripts, including scripts hidden in arguments.
• Evaluates effective low-privilege ACL grants while honoring deny ACEs.
• Detects direct writes, script appends, writable missing targets, and parent-directory replacement rights.
• Avoids UNC access and secret argument output.
• Is read-only and bounded to 1,024 folders, 2,048 tasks, 16 targets per action, and 64 findings.

Files changed

• winPEAS/winPEASexe/winPEAS/Checks/ApplicationsInfo.cs
• winPEAS/winPEASexe/winPEAS/Info/ApplicationInfo/PrivilegedScheduledTasks.cs
• winPEAS/winPEASexe/winPEAS/winPEAS.csproj
• winPEAS/winPEASexe/Tests/PrivilegedScheduledTaskTests.cs
• winPEAS/winPEASexe/Tests/winPEAS.Tests.csproj

Tests cover SYSTEM principal recognition, argument path extraction, deny-before-allow ACL behavior, and directory replacement requirements.

Validation

• Complete diff and git diff --check: passed.
• Project XML and compile-item validation: passed.
• C# syntax parsing for all changed sources: passed.
• Referenced Task Scheduler types and registration reviewed.
• No .NET, Mono, MSBuild, or C# compiler is installed locally, so the Windows build and MSTest suite could not be executed. No claim of local MSBuild validation is made.

The required chack_tools-save_discovered_vulnerability MCP tool was not exposed in this runtime, so an external finding record could not be saved.

Generated by the PEASS New Vulnerability Checks workflow. This PR must pass PEASS PR-tests and normal Chack-Agent review.

[github-actions]

The check is valuable and CI passes, but I have two blocking concerns. First, ExtractReferencedFilePaths treats every executable-looking argument as an execution target; ordinary copy/delete/output arguments such as /copy C:\Data\payload.dll or --output C:\Reports\result.jar can therefore produce high-severity false positives. Please restrict argument inspection to known interpreter/action semantics and add negative tests. Second, the limits still permit up to 2,048 tasks × 32 actions × 16 targets (over one million synchronous filesystem/ACL probes), with no global target/time budget and no exclusion for mapped network drives, so a scan can become very long or block on remote I/O. Please add a global probe/time limit and ensure targets reside on local drives.