Lion Cipher Lab
Find malicious and hidden scheduled tasks in the Windows task store (XML files + TaskCache)
- Digital Forensics & IR (DFIR)
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Scheduled tasks are one of the most common ways an intruder makes sure their foothold survives a reboot -- MITRE ATT&CK tracks it as T1053.005 and lists well over a hundred groups and malware families that use it. The obvious way to look for them is to ask Windows: open Task Scheduler or run schtasks /query. In 2022 Microsoft documented a piece of malware, Tarrask, that defeats exactly that by deleting a single registry value -- the task keeps running but disappears from both tools. Worse, the event logs that would have recorded the task being created are not audited by default, so on many…
What you'll learn
- Locating the two stores Windows keeps for every scheduled task: the XML files under C:\Windows\System32\Tasks and the registry TaskCache (Tree and Tasks keys)
- Parsing Task Scheduler XML with the correct namespace (http://schemas.microsoft.com/windows/2004/02/mit/task) using Python's xml.etree
- Scoring tasks for persistence red flags: user-writable action paths, LOLBins, encoded PowerShell, SYSTEM principals on logon/boot triggers, and Microsoft-masquerading names
- Decoding a PowerShell -enc argument (UTF-16LE base64) as an inert string so you can read what a task would run without running it
- Reconciling the XML store against TaskCache to expose hidden (SD-less) tasks, registry-only tasks and unregistered XML files
- Measuring what a schtasks-style listing misses compared with a full reconciliation, and naming the limits of both
Steps in this lab
- What a scheduled task is, and why intruders love it
- Where Windows actually keeps a task: two stores, not one
- Why not just read the event logs? (when to reach for this lab)
- Read the XML format before you parse it
- Build the synthetic task store
- Look at one raw task file and at the TaskCache export
- Write the hunter: inventory, score, reconcile
- Read the measurement: what the listing missed
- Read the false positive and the weak signals honestly
- Doing this on a real system (read-only)
- The limits -- what this cannot see
- Where this goes next