Scheduled Tasks

Location & availability

C:\Windows\System32\Tasks; TaskCache registry; TaskScheduler/Operational and relevant Security events

History availability depends on logging and retention. Task XML, registry state and event history should be examined together.

Fields to examine

• Action executable, arguments, triggers and principal.
• Task path and definition or registration context.
• Run-related events and results where logging captured them.

What it can establish

• Support a task’s recorded configuration and specifically logged task actions.

What it cannot prove

• Prove that an enabled trigger fired merely because the definition exists.
• Assume an unusual task name is malicious.

Use it in a screenshare

1. Preserve task definitions and relevant history without running the task.
2. Resolve the action path, quoting and arguments as data. Identify the account context and trigger conditions.
3. Correlate actual run events with process creation and file identity. Consider legitimate updater and maintenance tasks.

Worked example

A task launches a helper at logon. Its definition supports an automatic-start configuration. A run event plus the matching process creation is needed to establish that launch during the examined period.

Cross-check the finding

• Security event 4688 →Support process creation recorded by the audited host.
• Run and RunOnce keys →Support that a command was configured under a startup mechanism at collection.
• Windows services →Support an installed service configuration or a specific logged state change.

Sources

• Microsoft — Task Scheduler ↗
• Microsoft — Autoruns ↗