Skip to content
Scheduled Tasks

Series

Investigating scheduled tasks

3 posts in this series. Read them in order or jump to any one.

  1. Tarrask and Hidden Scheduled Tasks: How to Detect Them

    How Tarrask hid scheduled tasks by deleting the TaskCache SD value, the newer deny-ACL and Index variants, and how to find hidden tasks offline from the SOFTWARE hive.

  2. How to Detect Malicious Scheduled Tasks (Persistence Triage)

    A practical checklist to spot malicious scheduled tasks: user-writable paths, encoded PowerShell, LOLBins, SYSTEM principals, random names, hidden tasks and XML/registry mismatches.

  3. How to Analyze Scheduled Tasks in Your Browser (Worked Case)

    Step by step: load task XML, .job files and the SOFTWARE hive into a free in-browser parser, read hidden and registry-only tasks, fix time zones and export. With a fictional case.

All posts in this series

Tarrask and Hidden Scheduled Tasks: How to Detect Them
How Tarrask hid scheduled tasks by deleting the TaskCache SD value, the newer deny-ACL and Index variants, and how to find hidden tasks offline from the SOFTWARE hive.
scheduled-taskstarraskdefense-evasiontaskcache
How to Detect Malicious Scheduled Tasks (Persistence Triage)
A practical checklist to spot malicious scheduled tasks: user-writable paths, encoded PowerShell, LOLBins, SYSTEM principals, random names, hidden tasks and XML/registry mismatches.
scheduled-taskspersistencethreat-huntingdfir
How to Analyze Scheduled Tasks in Your Browser (Worked Case)
Step by step: load task XML, .job files and the SOFTWARE hive into a free in-browser parser, read hidden and registry-only tasks, fix time zones and export. With a fictional case.
scheduled-taskstoolscase-studydfir