Windows registry artifactScheduled Tasks (TaskCache)
Displays Scheduled Tasks and their last start/stop time
- Autoruns
- 1 key
SOFTWARE
Registry keys
1 key that RECmd reads for this artifact
SOFTWAREMicrosoft\Windows NT\CurrentVersion\Schedule\TaskCache\TasksDisplays Scheduled Tasks and their last start/stop time
References
6 links
- github.comTaskCache plugin(opens in new tab)
- digital-forensics.sans.org/media/DFPS_FOR508_v4.4_1-19.pdf(opens in new tab)
- jaiminton.com/cheatsheet/DFIR/(opens in new tab)
- jpcertcc.github.io/ToolAnalysisResultSheet/details/schtasks.htm(opens in new tab)
- dfirtnt.wordpress.com/registry-persistence-paths/(opens in new tab)
- forensafe.com/blogs/taskscheduler.html(opens in new tab)
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)