The Case of the Disappearing Scheduled Task

This episode is based upon a Microsoft Detection and Response (DART) blog post (see Resources section). I, along with two of my colleagues (Johnathan Sykes and Meaghan Bradshaw), performed extensive research regarding two different methods by which it is possible to create "hidden" Scheduled Tasks. While one of the methods has been discussed before, this research shows how it might be leveraged by a Threat Actor. The second technique, as best we can tell, is novel.

📖 Chapters

00:00 - Intro
01:18 - Demo

🛠 Resources

Tarrask Malware Uses Scheduled Tasks for Defense Evasion:

#Forensics #DigitalForensics #DFIR #ComputerForensics #WindowsForensics

[chaemelion]

I can't get enough of these kinds of videos, especially with this quality. Keep 'em coming!

[ciaobello]

ehat a nice Tutorial.. thank you for it

[-Giuseppe]

great video as always. Got just a question for you. What if you delete everything in the opposite way, first the scheduled task.. does the task still run?

[christophertharp]

is this because the task is sitting in the registry (memory) on one of those transactional log files?

[AbdallahMohamed-hnvk]

But how to delete this task if you could not see it?

[kerbalette]

Clearly the service just reads in the configs at start or when a new task is scheduled. Lots of programs work like this as they don’t constantly monitor the registry

[saulvilcavillena]

Restart the computer, but the malicious scheduled task continues to run, it seems that they injected some code into the svchost dll