Skip to content

Instantly share code, notes, and snippets.

@Purp1eW0lf
Created January 26, 2023 12:31
Show Gist options
  • Save Purp1eW0lf/84831280994f77861589285cdd160d77 to your computer and use it in GitHub Desktop.
Save Purp1eW0lf/84831280994f77861589285cdd160d77 to your computer and use it in GitHub Desktop.
# Make the schtask for the test
schtasks /create /tn "Find_Me" /tr calc.exe /sc minute /mo 100 /k
# Loop and parse \Taskcache\Tasks Registry location for scheduled tasks
## Parses Actions to show the underlying binary / commands for the schtask
## Could replace Actions with Trigggers on line 10, after ExpandedProperty
(Get-ItemProperty "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Schedule\Taskcache\Tasks\*").PSChildName |
Foreach-Object {
write-host "----Schtask ID is $_---" -ForegroundColor Magenta ;
$hexstring = (Get-ItemProperty "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Schedule\Taskcache\Tasks\$_" | Select -ExpandProperty Actions) -join ',' ;
($hexstring.Split(",",[System.StringSplitOptions]::RemoveEmptyEntries) | ?{$_ -gt '0'} | ForEach{[char][int]"$($_)"}) -join ''
}
# Then for the ID of interest under \Taskcache\Tree subkey
# Example: $ID = "{8E350038-3475-413A-A1AE-20711DD11C95}" ;
$ID = "{XYZ}" ;
get-itemproperty -path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Schedule\Taskcache\Tree\*" | ? Id -Match "$ID" | fl *Name,Id,PsPath
@Purp1eW0lf
Copy link
Author

image

image

@kacos2000
Copy link

kacos2000 commented Jan 26, 2023

This is my take on TaskCache (no idea on the structure of Triggers & Actions yet) 🙄

@Purp1eW0lf
Copy link
Author

TY for the contribution my friend!
However, I am specifically looking to generate a solution that turns the Actions(and Triggers) into the most human-readable they can be.

My current above one-liner achieves this, so whilst your script is interesting it doesn't quite solve the objective! But I look forward to new ideas you have for this objective

image

@kacos2000
Copy link

This might help: winreg-tasks-amd64.exe
Related blog and GitHub

Actions:
image
Triggers:
image
Timestamps:
image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment