Skip to content
Scheduled Tasks

Series

Investigating scheduled tasks

3 posts in this series. Read them in order or jump to any one.

  1. Tarrask and Hidden Scheduled Tasks: How to Detect Them

    How Tarrask hid scheduled tasks by deleting the TaskCache SD value, the deny-ACL and Index variants, and how to find hidden tasks offline in the SOFTWARE hive.

  2. How to Detect Malicious Scheduled Tasks (Persistence Triage)

    Checklist for malicious scheduled tasks: user-writable paths, encoded PowerShell, LOLBins, SYSTEM principals, random names, hidden tasks, XML/registry mismatch.

  3. How to Analyze Scheduled Tasks in Your Browser (Worked Case)

    Step by step: load task XML, .job files and the SOFTWARE hive into a free in-browser parser, read hidden and registry-only tasks, fix time zones and export.

All posts in this series

Tarrask and Hidden Scheduled Tasks: How to Detect Them
How Tarrask hid scheduled tasks by deleting the TaskCache SD value, the deny-ACL and Index variants, and how to find hidden tasks offline in the SOFTWARE hive.
scheduled-taskstarraskdefense-evasiontaskcache
How to Detect Malicious Scheduled Tasks (Persistence Triage)
Checklist for malicious scheduled tasks: user-writable paths, encoded PowerShell, LOLBins, SYSTEM principals, random names, hidden tasks, XML/registry mismatch.
scheduled-taskspersistencethreat-huntingdfir
How to Analyze Scheduled Tasks in Your Browser (Worked Case)
Step by step: load task XML, .job files and the SOFTWARE hive into a free in-browser parser, read hidden and registry-only tasks, fix time zones and export.
scheduled-taskstoolscase-studydfir