Skip to content
Scheduled Tasks

Posts tagged: #scheduled-tasks

← Back to all posts
How to Analyze Scheduled Tasks in Your Browser (Worked Case)
Step by step: load task XML, .job files and the SOFTWARE hive into a free in-browser parser, read hidden and registry-only tasks, fix time zones and export.
scheduled-taskstoolscase-studydfir
How to Detect Malicious Scheduled Tasks (Persistence Triage)
Checklist for malicious scheduled tasks: user-writable paths, encoded PowerShell, LOLBins, SYSTEM principals, random names, hidden tasks, XML/registry mismatch.
scheduled-taskspersistencethreat-huntingdfir
Tarrask and Hidden Scheduled Tasks: How to Detect Them
How Tarrask hid scheduled tasks by deleting the TaskCache SD value, the deny-ACL and Index variants, and how to find hidden tasks offline in the SOFTWARE hive.
scheduled-taskstarraskdefense-evasiontaskcache
.job File Forensics: Legacy Tasks in C:\Windows\Tasks
How to read legacy .job files: MS-TSCH fixed and variable sections, triggers, the local-time last run SYSTEMTIME, and when .job files appear on modern Windows.
scheduled-tasksjob-filelegacydfir
TaskCache Registry Forensics: Tree, Tasks and DynamicInfo
What the SOFTWARE hive's TaskCache key stores per scheduled task: Tree Id/Index/SD, Tasks values, DynamicInfo run times, Actions and Triggers blobs, the Hash.
scheduled-taskstaskcacheregistrydfir
Windows Scheduled Task XML Explained, Element by Element
Read Task Scheduler XML like an investigator: RegistrationInfo, Triggers, Principals, Settings, Actions, and the zoneless local times in Date and StartBoundary.
scheduled-tasksxmldfirtimestamps
Where Are Scheduled Tasks Stored? Locations and Acquisition
Every place Windows keeps scheduled tasks: System32\Tasks, SysWOW64\Tasks, C:\Windows\Tasks and TaskCache, plus how to collect them with KAPE or Velociraptor.
scheduled-tasksacquisitionkapevelociraptor
Windows Scheduled Task Forensics: The Complete Guide
Scheduled task forensics end to end: task XML files, the TaskCache registry key, legacy .job files and event logs, and how to correlate them in a case.
scheduled-taskspersistencedfirtaskcache