dissect.target.plugins.os.windows.tasks
#
Module Contents#
Classes#
Plugin for retrieving scheduled tasks on a Windows system. |
Attributes#
- dissect.target.plugins.os.windows.tasks.TaskRecord#
- class dissect.target.plugins.os.windows.tasks.TasksPlugin(target: dissect.target.target.Target)#
Bases:
dissect.target.plugin.Plugin
Plugin for retrieving scheduled tasks on a Windows system.
- Parameters:
target – The target system.
- PATHS#
- GLOB_PATHS = ['sysvol/windows/system32/GroupPolicy/DataStore/*/Machine/Preferences/ScheduledTasks/*',...#
- check_compatible() None #
Perform a compatibility check with the target.
This function should return
None
if the plugin is compatible with the current target (self.target
). For example, check if a certain file exists. Otherwise it should raise anUnsupportedPluginError
.- Raises:
UnsupportedPluginError – If the plugin could not be loaded.
- tasks() Iterator[TaskRecord | flow.record.GroupedRecord] #
Return all scheduled tasks on a Windows system.
On a Windows system, a scheduled task is a program or script that is executed on a specific time or at specific intervals. An adversary may leverage such scheduled tasks to gain persistence on a system.
References
https://en.wikipedia.org/wiki/Windows_Task_Scheduler
- Yields:
The scheduled tasks found on the target.