Trick or Treat on Specter Street: Ghost of the SOC

maybe I was too radical, i've deleted everything which was not by windows :)

Get-ScheduledTask | Where-Object { $_.TaskPath -notlike '\Microsoft\*' } | ForEach-Object {
  try {
    Disable-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -ErrorAction Stop | Out-Null
    Unregister-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -Confirm:$false -ErrorAction Stop
    Write-Host "Removed: $($_.TaskPath)$($_.TaskName)"
  } catch {
    Write-Warning "Failed: $($_.TaskPath)$($_.TaskName) — $($_.Exception.Message)"
  }
}

solved the lab and removed some services too much, but hey, .. to be on the safe side :)

This wasn't anything too suprising. A recusive search of the word svc (full name will be faster) will get you the creds you desire.

Same here. How do I get access to the service account? Been trying for hours! 

LewisMutton​ The answer to Q6 will clue you into the persistence mechanism you need to delete :)

DG​ seems to be some sort of god-level challenge exterminator. I assume they can help you.