> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/persistence/scheduled-tasks/scheduled-task-destination-system-artifacts.md).

# Scheduled Task Destination System Artifacts

Scheduled Task Destination System Artifacts Quick Reference

{% tabs %}
{% tab title="Event Log" %}
**security.evtx:**

* [<mark style="color:blue;">Event ID 4624</mark>](https://system32.eventsentry.com/security/event/4624)
  * Logon Type 3
  * Source IP/Logon Username
* [<mark style="color:blue;">Event ID 4672</mark>](https://system32.eventsentry.com/security/event/4672)
  * Logon User Name&#x20;
  * Logon by user with administrative rights&#x20;
  * Requirement for accessing default shares such as C$ and ADMIN$
* [<mark style="color:blue;">Event ID 4776</mark>](https://system32.eventsentry.com/security/event/4776)
  * NTLM if authenticating to Local System&#x20;
  * Source Host Name/Logon User Name
* [<mark style="color:blue;">Event ID 4698</mark>](https://system32.eventsentry.com/security/event/4698)
  * Scheduled task created
* [<mark style="color:blue;">Event ID 4702</mark>](https://system32.eventsentry.com/security/event/4702)
  * Scheduled task updated
* [<mark style="color:blue;">Event ID 4699</mark>](https://system32.eventsentry.com/security/event/4699)
  * Scheduled task deleted
* <mark style="color:blue;">Event ID</mark> [<mark style="color:blue;">4700</mark>](https://system32.eventsentry.com/security/event/4700)/[<mark style="color:blue;">4701</mark>](https://system32.eventsentry.com/security/event/4701)
  * Scheduled task enabled/disabled
    {% endtab %}

{% tab title="Registry" %}
**SOFTWARE**

* `Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks`
* `Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\`
* [ShimCache](broken://spaces/LHltGerC23QVyjq1LSxc/pages/ihpcmfjBmYkTGpgSNWk5) – SYSTEM
  * evil.exe&#x20;
* [AmCache.hve](broken://spaces/LHltGerC23QVyjq1LSxc/pages/BicH3sBBfCQNkjhCDL2w) – First Time Executed
  * evil.exe
    {% endtab %}

{% tab title="File System" %}

* File Creation
  * Evil.exe
* Job Files Created
  * C:\Windows\Tasks
* XML Task Files created in
  * C:\Windows\System32\Tasks
    * Author tag under "RegistrationInfo" can identify:
      * Source system name
      * Creator username
* [Prefetch ](broken://spaces/LHltGerC23QVyjq1LSxc/pages/mngP23Kjwo0DI64Sadh3)– C:\Windows\Prefetch
  * evil.exe-{hash}.pf
    {% endtab %}
    {% endtabs %}

## Overview

The source system artifacts provide crucial evidence about the use and management of scheduled tasks. These artifacts include:

### **Event Log**:

* **Event ID 4648**: Indicates logon with alternate credentials, which can be a sign of privilege escalation or lateral movement attempts.
* **Scheduled Task Events**:
  * **Event ID 4698**: Creation of a new scheduled task.
  * **Event ID 4702**: Update to an existing scheduled task.
  * **Event ID 4699**: Deletion of a scheduled task.
  * **Event IDs 4700/4701**: A scheduled task was enabled or disabled.

### **Registry**:

* **ShimCache**: Located at `SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache`
  * Provides a record of executed applications, including `schtasks.exe` and `at.exe`.
* **BAM/DAM**: Found under `SYSTEM\CurrentControlSet\Services\bam\UserSettings\{SID}`, it tracks applications executed by users, useful for identifying execution patterns of task scheduling tools.
* **AmCache.hve**: Contains records of programs executed, offering timestamps and file paths, crucial for timeline analysis involving `schtasks.exe` and `at.exe`.

### **Prefetch**:

* Prefetch files, specifically `C:\Windows\Prefetch\at.exe-{hash}.pf` and `C:\Windows\Prefetch\schtasks.exe-{hash}.pf`, record the execution of the AT command and Task Scheduler, providing insights into their usage frequency and last execution time.

## Deeper Dive

Understanding the implications of these artifacts requires a comprehensive analysis approach:

* **Event Log Analysis**: Event logs are foundational for timeline reconstruction and understanding task management actions. They reveal when and how scheduled tasks were manipulated, potentially highlighting unauthorized changes or the setup of malicious tasks.
* **Registry Examination**: The ShimCache, BAM/DAM, and AmCache.hve provide a forensic trail of executable runs, which is invaluable for identifying the use of scheduling tools in potentially malicious contexts. Analyzing these registry entries can reveal execution patterns and timelines for critical forensic analysis.
* **Prefetch Files Analysis**: Prefetch files for `at.exe` and `schtasks.exe` not only confirm the execution of these tools but also provide execution frequency and last execution date, aiding in the identification of suspicious task scheduling activities.

## Analyzing The Artifact

1. **Event Log Review**: Utilize tools like Event Viewer to scrutinize the Security logs for the specified Event IDs, understanding the context and timing of scheduled task manipulations.
2. **Registry Analysis**: Employ forensic tools to explore the mentioned registry paths for evidence of `schtasks.exe` and `at.exe` execution. This analysis can uncover usage patterns and potentially link to specific scheduled tasks or malicious activities.
3. **Prefetch Investigation**: Analyze the prefetch files for `at.exe` and `schtasks.exe` to determine how frequently these tools are used and their last known execution times. This information is critical for establishing a timeline of events and identifying abnormal use patterns.

## Tools for Analysis

* **Windows Event Viewer**: For accessing and analyzing event logs related to scheduled tasks.
* **Registry Analysis Tools**: Tools like Registry Explorer and RECmd can navigate and interpret ShimCache, BAM/DAM, and AmCache.hve entries.
* **Forensic Analysis Suites**: Comprehensive forensic suites like Autopsy or X-Ways Forensics can analyze prefetch files, alongside other artifacts, providing a holistic view of system activities.