Skip to content
Scheduled Tasks

Posts tagged: #dfir

← Back to all posts
How to Analyze Scheduled Tasks in Your Browser (Worked Case)
Step by step: load task XML, .job files and the SOFTWARE hive into a free in-browser parser, read hidden and registry-only tasks, fix time zones and export. With a fictional case.
scheduled-taskstoolscase-studydfir
How to Detect Malicious Scheduled Tasks (Persistence Triage)
A practical checklist to spot malicious scheduled tasks: user-writable paths, encoded PowerShell, LOLBins, SYSTEM principals, random names, hidden tasks and XML/registry mismatches.
scheduled-taskspersistencethreat-huntingdfir
.job File Forensics: Legacy Tasks in C:\Windows\Tasks
How to read legacy .job files: the MS-TSCH fixed and variable sections, triggers, the local-time last run SYSTEMTIME, and when .job files still appear on modern Windows.
scheduled-tasksjob-filelegacydfir
TaskCache Registry Forensics: Tree, Tasks and DynamicInfo
What the TaskCache key in the SOFTWARE hive stores for each scheduled task: Tree Id/Index/SD, Tasks values, DynamicInfo run times, Actions and Triggers blobs, and the Hash.
scheduled-taskstaskcacheregistrydfir
Windows Scheduled Task XML Explained, Element by Element
Read a Task Scheduler XML file like an investigator: RegistrationInfo, Triggers, Principals, Settings and Actions, and the zoneless local times in Date and StartBoundary.
scheduled-tasksxmldfirtimestamps
Windows Scheduled Task Forensics: The Complete Guide
Scheduled task forensics end to end: task XML files, the TaskCache registry key, legacy .job files and event logs, and how to correlate them in a case.
scheduled-taskspersistencedfirtaskcache