ParseScheduledTasksXML Hands-on Labs

Choose the browser simulation for coached command and CSV practice, or complete the Full Lab with supplied scheduled-task evidence in an isolated Windows VM.

Interactive Lab

Hands-on scheduled-task proof of concept

Parse it. Filter it. Corroborate it.

Turn verified task XML into reviewable derived output, identify one focused lead and explain what the definition can and cannot support.

⏱ Setup: 20–30 min · Exercise: 40–60 min◆ Guided beginner✓ Evidence required

Start the Full Lab

Full Lab

Isolated Windows VM · Setup: 20–30 min · Exercise: 40–60 min

Scheduled Task Definition Full Lab

PowerShell, verified task evidence, Timeline Explorer and separate case storage required

Use supplied or authorised evidence

Prefer the supplied Tasks directory. Parsing a live System32\Tasks directory creates host activity and may encounter changing or locked data.

Objective

For case SUSA-PST-072, determine whether the supplied task definitions contain an enabled task named \SystemHealthUpdate that launches PowerShell as SYSTEM, preserve the parsed result, and state what further evidence is needed to assess execution and intent.

Case package

Verified Tasks directory, manifest, Task Scheduler Operational EVTX and payload metadata.

Tools

Recorded ParseScheduledTasksXML script, PowerShell and Timeline Explorer.

Storage

Separate source, derived, exports and notes directories on controlled storage.

01

Activity 1: Establish the boundary

1. Record authority, case question, host/image identity, source time zone and examiner.
2. Verify the supplied manifest and identify the Tasks working copy.
3. Record script source, retrieval/commit reference, path, SHA-256 and effective execution policy.
4. Create empty derived, exports and notes directories.
5. Count the supplied task files and record inaccessible or malformed items.

Milestone 1Inputs are attributableEvidence, tool and output locations are identified before parsing.

02

Activity 2: Parse and triage

1. Run the parser against the verified Tasks directory with -Output pointing to derived.
2. Record the exact command, start/finish time, console messages and generated filename.
3. Hash the CSV, record its row count and compare it with the source-file count.
4. Open the CSV in Timeline Explorer and filter for SystemHealthUpdate.
5. Preserve the full selected row and neighbouring context, including principal, logon type, enabled state and complete action string.

Milestone 2Lead preservedThe selected row remains linked to source, command and derived output.

03

Activity 3: Corroborate and report

1. Inspect the original task XML and compare it with the parsed row.
2. Review supplied Task Scheduler Operational events for registration and execution-related records.
3. Establish whether the configured payload existed and preserve its metadata and hash.
4. Add relevant process, PowerShell or Prefetch evidence if supplied.
5. Report observation, interpretation, confidence, competing explanations and limitations separately.

Case question and authority:
Source identity, path, count and manifest:
Parser identity, command and output hash:
Selected task fields and original XML path:
Corroborating records:
Conclusion, confidence and limitations:

Milestone 3Finding is boundedThe report distinguishes configured task state from registration, execution and intent.

Full Lab evidence checklist

• Core completion

  • Authority, question, host/image identity and time zone.
  • Tasks source path, count, metadata, manifest and hashes.
  • Script source/version reference, path, hash and execution context.
  • Exact command, run times, messages, errors and output path.
  • CSV hash, row count, selected row and neighbouring context.
  • Original XML path and comparison with parsed fields.
  • Task logs, payload and available execution-related evidence.
  • Bounded conclusion, confidence, alternatives and limitations.

0 of 8 recorded Mark each saved item.Reset

Troubleshooting

Symptom	First check
Script will not run	Confirm script path, policy scope, hash review and PowerShell errors.
-Path is rejected	Confirm an existing directory and readable evidence copy.
-Output is rejected	Create the destination directory before running the parser.
Rows are missing	Compare counts and inspect malformed/unreadable XML individually.
Timeline filter finds nothing	Clear filters, confirm the complete task name and inspect action arguments.
Execution remains uncertain	Review Task Scheduler logs and independent process/payload evidence.

Clean up

Close Timeline Explorer and PowerShell, preserve verified source and case output, remove disposable working material only when authorised, and restore the lab VM snapshot.

PreviousParse and reviewReviewReturn to overview