dissect.target.plugins.os.windows.tasks

Module Contents

Classes

TasksPlugin

Plugin for retrieving scheduled tasks on a Windows system.

Attributes

log
TaskRecord

dissect.target.plugins.os.windows.tasks.log

dissect.target.plugins.os.windows.tasks.TaskRecord

class dissect.target.plugins.os.windows.tasks.TasksPlugin(target: dissect.target.Target)

Bases: dissect.target.plugin.Plugin

Plugin for retrieving scheduled tasks on a Windows system.

Parameters:

target – The target system.

PATHS

GLOB_PATHS = ['sysvol/windows/system32/GroupPolicy/DataStore/*/Machine/Preferences/ScheduledTasks/*',...

task_files = []

check_compatible() → None

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

tasks() → Iterator[TaskRecord | flow.record.GroupedRecord]

Return all scheduled tasks on a Windows system.

On a Windows system, a scheduled task is a program or script that is executed on a specific time or at specific intervals. An adversary may leverage such scheduled tasks to gain persistence on a system.

References

https://en.wikipedia.org/wiki/Windows_Task_Scheduler

Yields:

The scheduled tasks found on the target.