Windows.Registry.ScheduledTasks

name: Windows.Registry.ScheduledTasks
author: Matt Green - @mgreen27
description: |
  This artifact will collect Scheduled task information from the registry without
  relying on the existence of an XML file in C:\\Windows\\System32\\Tasks.

  The artifact will attempt to find relevant XML data if exists.
  There is also an option to show only tasks  missing a Security Descriptor.

  TODO: cleanup, write test and add to main repo

reference:
  - https://www.youtube.com/watch?v=ZQeWgTP4PaY

type: CLIENT

parameters:
   - name: OnlyShowNullSD
     type: bool
     description: only show entries with null security descriptor

sources:
  - precondition:
      SELECT OS From info() where OS = 'windows'

    query: |
      LET xml <= SELECT *,
            regex_replace(source=OSPath,re='''^C:\\Windows\\System32\\Tasks''',replace='') as Path
        FROM Artifact.Windows.System.TaskScheduler()

      LET tree <= SELECT Id,SD,Index
        FROM read_reg_key(globs="HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Schedule/TaskCache/Tree/**", accessor="reg")

      LET find_xml(path) = SELECT OSPath, Command, Arguments, ComHandler, UserId, _XML
        FROM xml WHERE Path = path

      LET tree_sd(id) = SELECT Id,SD,Index
        FROM tree WHERE Id = id

      LET tasks = SELECT
            basename(path=Key.FileInfo.FullPath) as TaskID,
            Key.FileInfo.ModTime as Mtime,
            Path,
            Hash,
            Version,
            SecurityDescriptor,
            Source,
            Author,
            Description,
            URI,
            Triggers,
            Actions,
            DynamicInfo,
            if(condition=Schema,
                then=format(format='0x%x',args=Schema),
                else='') as Schema,
            Date,
            Key.FileInfo.FullPath as OSPath,
            find_xml(path=Path)[0] as XmlEntry
        FROM read_reg_key(globs="HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Schedule/TaskCache/Tasks/**", accessor="reg")

      SELECT
        TaskID,Mtime,Path,Hash,Version,
            SecurityDescriptor,
            tree_sd(id=TaskID)[0].SD as TreeSD,
            Source, Author, Description,URI,Triggers, Actions, DynamicInfo,
            Schema,Date,
            OSPath,
            XmlEntry
        FROM tasks
        WHERE NOT if(condition= OnlyShowNullSD,
            then= TreeSD,
            else= False )

column_types:
  - name: Hash
    type: hex
  - name: Triggers
    type: hex
  - name: DynamicInfo
    type: hex
  - name: TreeSD
    type: hex