Parse and Review Scheduled Tasks

Work from an identified Tasks directory when possible. Preserve the directory structure, source metadata and manifest before creating derived CSV output.

Prepare the evidence boundary

• Source copy
  Record host/image identity, collection method, root path, timestamps, hashes and any inaccessible task files.
• Derived output
  Create an existing case-linked directory such as X:\SUSA-PST-072\derived and record parser version, command, time and errors.
• Time basis
  Record source time zone and note which exported values are UTC, embedded XML values or file-system metadata.
• Corroboration plan
  Retain Task Scheduler Operational logs, payload metadata and other sources needed to test execution and attribution.

Parse the Tasks directory

The original SUSA procedure opens an administrator PowerShell prompt, enters the tool directory and parses C:\Windows\System32\Tasks:

cd C:\Tools\ParseScheduledTasksXML
powershell.exe -NoProfile -ExecutionPolicy Bypass
.\ParseScheduledTasksXML.ps1 -Path "C:\Windows\System32\Tasks"

For a controlled evidence copy, use the optional output parameter:

.\ParseScheduledTasksXML.ps1 `
  -Path "X:\SUSA-PST-072\source\Tasks" `
  -Output "X:\SUSA-PST-072\derived"

The parser recursively reads task definitions and writes a UTC-timestamped *_ParsedScheduledTasks_XML.csv file. It suppresses individual parsing errors, so record input counts and investigate unexplained differences between source files and CSV rows.

Review in Timeline Explorer

Open the generated CSV in Timeline Explorer and retain the exact CSV path and hash. Start broad, then filter on fields relevant to the case question.

1 · Establish normal contextTask name, author and description

Compare vendor, Windows and organisation-specific naming patterns before labelling an outlier.

2 · Review security contextPrincipal, logon type and enabled state

Ask whether the configured account and trigger fit the stated purpose.

3 · Inspect the actionCommand, arguments or COM handler

Resolve paths and variables; preserve the complete string rather than a cropped value.

4 · CorroborateLogs, payload and surrounding activity

Use Task Scheduler Operational events and independent host evidence to test creation and execution hypotheses.

Interpret the result

Observation	What it supports	What it does not prove
XML defines a PowerShell action	Configured command and arguments at collection time	That the command executed or succeeded
Principal is SYSTEM	Configured security context	Malicious intent or human attribution
Task is enabled	Definition permits scheduling under its triggers	A trigger fired during the incident
Registration date is present	Embedded registration value	Reliable creation time without corroboration

Useful next sources

Correlate selected rows with Microsoft-Windows-TaskScheduler/Operational events, the original task file and metadata, payload existence and hashes, Prefetch or process telemetry, PowerShell logs and relevant user artefacts.

Troubleshooting

Symptom	First check
Path validation fails	Confirm the directory exists and that the process can read it.
Output validation fails	Create the -Output directory before running the script.
CSV has fewer rows than source files	Check malformed/unreadable XML, permissions and suppressed parsing errors.
Action field is blank	The task may use a COM handler or another structure; inspect the source XML.
Times appear inconsistent	Separate file modified time, embedded registration date and source time zone.

PreviousInstall and openNextHands-on Labs