Description

Each row reconstructs a Registry-backed scheduled task, with task identity, author, triggers, actions, command and arguments, registration or run metadata, exit code, and security information where available. Use it to hunt persistence and correlate task actions with binaries or accounts. Registration does not prove execution, and last-run fields may be absent or stale.

Timeline

Timeline Field	Data Field
Related User	key_security.owner_sid
Description	task
Additional Description	actions.action_type
	actions.exec_command
	actions.exec_arguments
	actions.com_data

Fields

Output Name	Data Type	Description
guid	String	unique identifier (GUID) of the scheduled task
uri	String	URI associated with the scheduled task
task	String	full registry path of the scheduled task definition
task_description	String	human‑readable description of the task
source	String	origin source of the task
author	String	author or creator of the scheduled task
data	String	raw data blob stored for the task
documentation	String	documentation URL or text linked to the task
hash	String	hex‑encoded hash of the task definition
schema	Int	schema version number of the task definition
trigger	String	trigger configuration that defines when the task runs
version	String	version string of the scheduled task
actions[]	Array[Object]
actions[].action_id	String	identifier of the action within the task
actions[].action_type	String	type of action (e.g., Exec, ComHandler, SendEmail, ShowMessage)
actions[].exec_command	String	executable command to run for Exec actions
actions[].exec_arguments	String	command‑line arguments for the executable
actions[].exec_working_dir	String	working directory used when executing the command
actions[].com_classid	String	COM class identifier (CLSID) for ComHandler actions
actions[].com_data	String	additional data passed to the COM handler
actions[].email_from	String	sender address for SendEmail actions
actions[].email_to	String	recipient address(es) for SendEmail actions
actions[].email_cc	String	CC address(es) for SendEmail actions
actions[].email_bcc	String	BCC address(es) for SendEmail actions
actions[].email_replyto	String	Reply‑To address for SendEmail actions
actions[].email_server	String	SMTP server used for SendEmail actions
actions[].email_subject	String	subject line of the email
actions[].email_body	String	body content of the email
actions[].email_attachments	String	list of attachment filenames for the email
actions[].message_body	String	text displayed in the message box for ShowMessage actions
actions[].message_title	String	title of the message box for ShowMessage actions
security_descriptor	Object
boot	Object
boot.mtime	DateTime	modification timestamp of the boot sub‑key for the task
logon	Object
logon.mtime	DateTime	modification timestamp of the logon sub‑key for the task
maintenance	Object
maintenance.mtime	DateTime	modification timestamp of the maintenance sub‑key for the task
plain	Object
plain.mtime	DateTime	modification timestamp of the plain sub‑key for the task
tree	Object
tree.mtime	DateTime	modification timestamp of the tree sub‑key for the task
creation_date	String	timestamp when the scheduled task was initially created
last_run_launch_date	DateTime	timestamp of the most recent task launch
last_run_exit_code	Int	exit code returned by the latest execution of the task
last_run_exit_date	DateTime	timestamp when the latest task execution completed
registration_date_local	DateTime	date the task was registered
key_path	String	full registry key name
key_modif_time	DateTime	last modification timestamp of the registry key
key_security	Object
key_security.owner_sid	String	SID of the user that owns the registry key
key_security.group_sid	String	SID of the group that owns the registry key
key_security.control_flags[]	Array[String]	security descriptor control flags for the key
key_security.sacl_aces[]	Array[Object]
key_security.sacl_aces[].ace_type	String	type of ACE (e.g., allow, deny)
key_security.sacl_aces[].ace_flags[]	Array[String]	ACE flags that modify inheritance or behavior
key_security.sacl_aces[].rights[]	Array[String]	permissions granted or denied by the ACE
key_security.sacl_aces[].account_sid	String	SID of the account the ACE applies to
key_security.sacl_aces[].ace_size	Int	declared ACE size in bytes
key_security.sacl_aces[].object_type_guid	String	GUID identifying the object type governed by the ACE
key_security.sacl_aces[].inherited_object_type_guid	String	GUID identifying the inherited object type governed by the ACE
key_security.sacl_aces[].raw_hex	String	raw ACE bytes preserved as hexadecimal
key_security.dacl_aces[]	Array[Object]
key_security.dacl_aces[].ace_type	String	type of ACE (e.g., allow, deny)
key_security.dacl_aces[].ace_flags[]	Array[String]	ACE flags that modify inheritance or behavior
key_security.dacl_aces[].rights[]	Array[String]	permissions granted or denied by the ACE
key_security.dacl_aces[].account_sid	String	SID of the account the ACE applies to
key_security.dacl_aces[].ace_size	Int	declared ACE size in bytes
key_security.dacl_aces[].object_type_guid	String	GUID identifying the object type governed by the ACE
key_security.dacl_aces[].inherited_object_type_guid	String	GUID identifying the inherited object type governed by the ACE
key_security.dacl_aces[].raw_hex	String	raw ACE bytes preserved as hexadecimal