Scheduled Tasks

What it is

The Task Scheduler service runs programs at a set time, at boot, at logon or when an event occurs. Attackers use it for persistence, for privilege escalation (tasks can run as SYSTEM) and for lateral movement, since schtasks /create /s <host> registers a task on a remote machine.

A task leaves traces in three places: its definition file on disk, a set of TaskCache registry keys in the SOFTWARE hive, and event logs when auditing is on. Comparing the three is how you spot tampered or hidden tasks.

Location

Legacy .job files can still appear in C:\Windows\Tasks on newer systems, mostly for tasks created with the deprecated at.exe (At1.job, At2.job…).

TaskCache layout:

• TaskCache\Tree\<path>\<TaskName>: values Id (task GUID), Index and SD (security descriptor).
• TaskCache\Tasks\{GUID}: values such as Path, Actions, Triggers, DynamicInfo, Author, Description, Date, URI.
• TaskCache\Boot, Logon, Plain, Maintenance: GUID lists that sort tasks by trigger type.

What it proves

• Persistence or planned execution: a command, its arguments and the account it runs under.
• Who registered it: the XML Author/UserId, the account in event 106 and in Security 4698.
• When: creation, last run and last successful run times in DynamicInfo, and run events in the Operational log.
• It does not prove the action succeeded: confirm with event 201 (result code), Prefetch or process creation events. The XML Author and Date are free text and can be forged.

Key fields

Timestamps

Retention and clearing

• Tasks stay until deleted. Deleting a task removes the XML and the TaskCache keys; the Operational log (141) and Security log (4699) are then the main traces, plus deleted-file evidence in the USN journal and older SOFTWARE hives in volume shadow copies.
• Security 4698 requires "Audit Other Object Access Events", and the TaskScheduler Operational channel may be disabled depending on build and configuration ("Enable All Tasks History"). Check whether the channel is enabled and holds events before reading anything into an empty result.
• Hidden tasks: the Tarrask malware deleted the SD value under TaskCache\Tree. The task then disappears from schtasks /query and the console but keeps running. The deletion needs SYSTEM rights. The XML file and the Tasks\{GUID} key remain.
• Event logs roll over by size, so on busy systems the Operational log may only cover days or weeks.

Collection

• KAPE target: ScheduledTasks (XML, .job, SchedLgU.txt, PowerShell scheduled jobs), plus RegistryHivesSystem for TaskCache and EventLogs for the event channels.
• Velociraptor (Windows.Triage.Targets): ScheduledTasks, RegistryHivesSystem, EventLogs. Live analysis: Windows.System.TaskScheduler (parses the XML) and Windows.EventLogs.ScheduledTasks.
• Built-in: the XML files can be copied directly; the SOFTWARE hive is locked, so use reg save or a shadow copy.

robocopy C:\Windows\System32\Tasks E:\case\Tasks /E /COPY:DAT /DCOPY:T
reg save HKLM\SOFTWARE E:\case\SOFTWARE.hiv
wevtutil epl Microsoft-Windows-TaskScheduler/Operational E:\case\TaskScheduler.evtx
schtasks /query /fo csv /v > E:\case\schtasks.csv

Parsing tools

• Velociraptor: Windows.System.TaskScheduler lists commands and user context from the XML; Windows.EventLogs.ScheduledTasks collates Operational and Security events.
• RegRipper: taskcache and tasks plugins (SOFTWARE hive), with _tln timeline variants.
• winreg-tasks (G DATA, open source): Kaitai definitions and scripts that decode Actions, Triggers and DynamicInfo.
• TaskSchedulerView (NirSoft, free): GUI listing of tasks on a live system.
• EvtxECmd (Eric Zimmerman): maps TaskScheduler and Security task events to CSV.
• Plaso: winjob parser for .job files and the windows_task_cache registry plugin.

Investigation tips

• Diff the task list from three sources: XML files, TaskCache\Tree and TaskCache\Tasks. A Tree entry without SD, or a GUID with no matching XML, deserves attention.
• Flag actions pointing to powershell.exe -enc, cmd.exe /c, rundll32.exe, mshta.exe, script files, or binaries in \Users\, \ProgramData\ or \Windows\Temp\.
• Task names often imitate Microsoft ones (\Microsoft\Windows\...\Update); check the author, path and binary signature rather than the name.
• Security 4698 embeds the full task XML, so it can recover the definition of a task that was later deleted.
• Remote registration shows up as a network logon (logon type 3) on the target just before event 106; correlate in the event logs.
• Confirm execution with Prefetch of the action binary, and check services and WMI for parallel persistence.