Skip to content

ParseScheduledTasksXML

What ParseScheduledTasksXML does

Scheduled-task definition review

ParseScheduledTasksXML is a PowerShell parser that recursively reads Windows Task Scheduler XML definitions and exports selected registration, principal, settings and action fields to a timestamped CSV. It turns many individual task files into a reviewable table without making the table proof that a task ran.

  • Inventory definitions
    Review task name, author, description, principal, logon type and enabled state together.
  • Expose actions
    Bring executable commands, arguments and COM-handler identifiers into a sortable CSV.
  • Focus follow-up
    Identify definitions that warrant comparison with task files, Task Scheduler logs and surrounding host activity.

A definition is not an execution record

A parsed task shows configured XML at the time collected. It does not alone prove the task executed, who created it, whether its payload existed or whether its purpose was malicious.

Choose your journey

01Install and open

Retrieve, verify and stage the PowerShell script without weakening the host permanently.

Complete when script provenance and execution context are recorded.Beginner · PowerShell · 10–20 min 02Parse and review

Parse an identified Tasks directory, preserve the CSV and triage it in Timeline Explorer.

Complete when a selected row remains linked to its source task.Practical · Training evidence · 20–35 min 03Hands-on Labs

Practise the command and review workflow or complete an evidence-driven Full Lab.

Complete when another analyst can reproduce the result.Guided beginner · 20–90 min

How the workflow fits together

1 Define question›2 Verify source›3 Parse XML›4 Triage CSV›5 Corroborate

Use the source task

Retain the collected task path, size, timestamps and hash. The CSV is derived output; its row must remain attributable to the XML definition it represents.

Read fields together

Task name, principal, logon type, enabled state, action and arguments provide context as a group. A suspicious-looking command is a lead, not a verdict.

What the parser exports

RegistrationDate, author, description and task name

Useful for attribution leads, naming and task purpose, subject to source reliability.

Security contextUser context and logon type

Shows the configured principal, not necessarily the interactive human responsible.

State and actionEnabled, command and arguments

Supports review of what the task was configured to launch.

COM actionClass ID and handler data

Preserves COM-handler context where an executable action is not used.

Before you begin

Authority

Use supplied evidence or an explicitly authorised Windows training host.

Source

Prefer a verified copy of the Tasks directory rather than parsing the live system directly.

Output

Create a separate existing directory for CSV output, notes and hashes.

Analyst decisionA task row launches PowerShell as SYSTEM. What can you conclude?
NextInstall and open