Posts tagged: #taskcache

How Tarrask hid scheduled tasks by deleting the TaskCache SD value, the deny-ACL and Index variants, and how to find hidden tasks offline in the SOFTWARE hive.

What the SOFTWARE hive's TaskCache key stores per scheduled task: Tree Id/Index/SD, Tasks values, DynamicInfo run times, Actions and Triggers blobs, the Hash.

Scheduled task forensics end to end: task XML files, the TaskCache registry key, legacy .job files and event logs, and how to correlate them in a case.