-
Notifications
You must be signed in to change notification settings - Fork 187
/
ScheduledTasks.tkape
48 lines (47 loc) · 1.32 KB
/
ScheduledTasks.tkape
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
Description: Scheduled tasks (*.job and XML)
Author: Eric Zimmerman
Version: 1.1
Id: e5dc4367-2e6b-49bf-a90a-d4c1598bbe28
RecreateDirectories: true
Targets:
-
Name: at .job
Category: Persistence
Path: C:\Windows\Tasks\
FileMask: '*.job'
-
Name: at .job
Category: Persistence
Path: C:\Windows.old\Windows\Tasks\
FileMask: '*.job'
-
Name: at SchedLgU.txt
Category: Persistence
Path: C:\Windows\
FileMask: SchedLgU.txt
-
Name: at SchedLgU.txt
Category: Persistence
Path: C:\Windows.old\Windows\
FileMask: SchedLgU.txt
-
Name: XML
Category: Persistence
Path: C:\Windows\System32\Tasks\
Recursive: true
-
Name: XML
Category: Persistence
Path: C:\Windows\syswow64\Tasks\
Recursive: true
-
Name: XML
Category: Persistence
Path: C:\Windows.old\Windows\System32\Tasks\
Recursive: true
# Documentation
# http://windowsir.blogspot.com/2009/09/parsing-job-files.html
# https://www.sans.org/blog/windows-scheduler-at-job-forensics
# https://forensicswiki.xyz/wiki/index.php?title=Windows_Job_File_Format
# https://www.forensafe.com/blogs/taskschd.html
# https://stmxcsr.com/persistence/scheduled-tasks.html