> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/persistence/scheduled-tasks.md).

# Scheduled Tasks

Scheduled tasks can be used for persistence by threat actors in various ways. Key artifacts associated with the creation, execution, and management of scheduled tasks in Windows include:

## **Source System Artifacts**:

* **Event Log**:
  * **Event ID 4648**: Logon specifying alternate credentials.
  * **Scheduled Task Events Event IDs**: 
    * 4698 (creation)
    * 4702 (update)
    * 4699 (deletion)
    * 4700/4701 (enabled/disabled).
* **Registry**:
  * **ShimCache**: `SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache`
  * **BAM/DAM**: `SYSTEM\CurrentControlSet\Services\bam\UserSettings\{SID}`
  * **AmCache.hve**: Lists programs executed, including `schtasks.exe` and `at.exe`.
* **Prefetch**:
  * `C:\Windows\Prefetch\at.exe-{hash}.pf`
  * `C:\Windows\Prefetch\schtasks.exe-{hash}.pf`

## **Destination System Artifacts**:

* **Event Log**:
  * Event ID 4624: Successful account logon.
  * Event ID 4672: Special privileges assigned to new logon.
  * Event ID 4776: The computer attempted to validate the credentials for an account.
  * **Scheduled Task Events Event IDs**: 
    * 4698 (creation)
    * 4702 (update)
    * 4699 (deletion)
    * 4700/4701 (enabled/disabled).
* **Registry**:
  * **Tasks and Tree**: 
    * `Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks`
    * `Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree` 
      * Store details of scheduled tasks.
* **File System**:
  * Job Files: `C:\Windows\Tasks`
  * XML Task Files: `C:\Windows\System32\Tasks`

## Overview

Scheduled tasks are integral to Windows operations, automation, and persistence mechanisms. These artifacts are pivotal:

* **Event IDs 4698, 4702, 4699, 4700 & 4701** provide forensic evidence of task manipulation.
* **Registry keys** under `TaskCache` reveal task configurations and metadata.
* **Prefetch files** for `schtasks.exe` and `at.exe` indicate execution and can help establish a timeline.
* **File paths** like `C:\Windows\System32\Tasks` and `C:\Windows\Tasks` contain the actual task files, potentially including malicious tasks.

## Analyzing The Artifact

1. **Examine Scheduled Tasks**: Use the Task Scheduler GUI (`taskschd.msc`) or `schtasks.exe` to list and review tasks. Pay attention to tasks with unusual triggers or actions.
2. **Event Log Analysis**: Investigate the Security and Microsoft-Windows-TaskScheduler operational logs for creation, modification, and execution of tasks. Correlate these events with other suspicious activities.
3. **Registry Examination**: Navigate to `Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache` to analyze task definitions and metadata. Tools like Registry Explorer can be invaluable.
4. **Prefetch Analysis**: Review prefetch files for execution patterns of `schtasks.exe`, `at.exe`, and potentially malicious executables like `evil.exe`.
5. **File System Scrutiny**: Inspect `C:\Windows\System32\Tasks` and `C:\Windows\Tasks` for task files, especially those with recent timestamps or linked to other indicators of compromise.

## Tools for Analysis

* **Task Scheduler and Command Line Utilities**: For reviewing and managing scheduled tasks.
* **Windows Event Viewer**: For detailed logs related to task creation, execution, and deletion.
* **Registry Tools** (Registry Explorer, RECmd): For deep dives into the registry entries associated with tasks.
* **Forensic Analysis Tools** (Autopsy, X-Ways Forensics): For comprehensive analysis of file systems, prefetch files, and registry keys.
* **PowerShell Scripts**: Custom scripts can automate the extraction and analysis of scheduled task artifacts.