Unleash the power of scheduled tasks and uncover hidden secrets in Windows! Did you know that lurking beneath the surface are approximately 150 scheduled tasks by default, with over 40 set to hidden by default? Prepare to dive deep into the fascinating (aka, frustrating) world of these elusive artifacts! Join me as we embark on an enthralling journey, delving into the intricate details and challenges surrounding scheduled tasks. Discover how Microsoft typos, baffling naming schemes, and cryptic execution details make detecting anomalies a “thrilling” pursuit. But fear not, for there is hope! This captivating presentation will arm you with potent PowerShell scripts, powerful Elasticsearch dashboards, and an enhanced understanding of hunting down malicious persistence. Get ready to transform your perspective on scheduled tasks and become a hero in shining a spotlight on their hidden mysteries!

1. GRRCON 2023
BRANDON DEVAULT
Principal Security Author
 Pluralsight
Cyber Operations
 Air National Guard
The Great Task Heist:
Stealing the Spotlight on
Scheduled Tasks
/in/brandon-devault @DeVaultSecurity
www.devaultsecurity.com

2. AGENDA
Introduction & Detection
PowerShell Analysis
Dashboard Analysis with Elastic
Q&A

3. PERSISTENCE TECHNIQUES
MITRE
Account Manipulation BITS Jobs
Boot or Logon Autostart
Execution
Boot or Logon
Initialization Scripts
Browser Extensions
Compromise Client
Software Binary
Create Account
Create or Modify
System Process
Event Triggered
Execution
External Remote
Services
Hijack Execution Flow Implant Internal Image
Modify Authentication
Process
Office Application
Startup
Pre-OS Boot
Scheduled Task/Job
Server Software
Component
Traffic Signaling Valid Accounts

4. PERSISTENCE TECHNIQUES
MITRE
SCHEDULED TASK / JOB
T1053.002 – At
T1053.003 – Cron
T1053.005 – Scheduled Task
T1053.006 – Systemd Timers
T1053.007 – Container Orchestration Job
*132 Named Threat Groups having used this persistence method

5. DETECTION
METHODS
Command Execution
• WMI, PowerShell, cmd …
Process Creation
Registry Key Creation
Log Detection!
• Sysmon
• Event ID: 4698, 4700, & 4701
File Modification
• %systemroot%Sytem32Tasks

6. POWERSHELL
ANALYSIS

8. DASHBOARD
ANALYSIS
WITH ELASTIC

9. EXPORT
JOURNEY

10. ATTEMPT #1

11. STEP 1
EXPORT THE TASKS (USING POWERSHELL)
$savefolder = "C:SomeFolder"
Get-ScheduledTask |
ForEach-Object {
$_.TaskName
Export-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath |
Out-file (Join-Path $savefolder "$($_.TaskName).xml")
}

12. STEP 2
Convert to JSON (using Python)
import xmltodict, json, os
directory = '/some/directory/’
for filename in os.listdir(directory):
if filename.endswith(".xml"):
with open(filename, 'rb') as f:
XML_content = f.read()
x = xmltodict.parse(XML_content)
j = json.dumps(x)
print (filename)
filename = filename.replace('.xml', '')
output_file = open(filename + '.json', 'w')
output_file.write(j)

13. STEP 3
IMPORT!
Not a
Proper
NDJSON
Format

14. STEP 3
IMPORT!
Not a
Proper
NDJSON
Format

15. ATTEMPT #2

16. JSON TO NDJSON (USING JQ)
cat test.json | jq -c '.[]' > testNDJSON.json

17. IMPORT!
Multi-nested
Complex
JSON file

18. IMPORT!
Multi-nested
Complex
JSON file

19. ATTEMPT #3

20. CONVERT
JSON TO NDJSON (USING PYTHON)
< Super Awesome Code >

21. IMPORT!
Still too
Complex…

22. IMPORT!
Still too
Complex…

23. ATTEMPT #4

24. CREATE A
LOGSTASH PIPELINE
XML Parser
30 minutes later…
Task Scheduler schema:
658 lines…

25. ATTEMPT #5

26. CONVERT TO
CSV
Tool:
SaveJson2CSV
Gunamoi Software

27. IMPORT!

28. IMPORT!
ish...

29. QUESTIONS?
• www.devaultsecurity.com
• linkedin.
• twitter. devaultsecurity.com
• github.
• brandon-devault@pluralsight.com
• https://app.pluralsight.com/profile/author/
brandon-devault
• https://github.com/Oofles/scheduled-tasks
}