Planificateur de taches et le registre¶

# List all scheduled task GUIDs and their paths from the registry
Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks" |
    ForEach-Object {
        [PSCustomObject]@{
            GUID = $_.PSChildName
            Path = $_.GetValue("Path")
        }
    } | Format-Table -AutoSize

# Verify both locations exist for a specific task
$taskName = "\Microsoft\Windows\Defrag\ScheduledDefrag"
$xmlPath  = "$env:SystemRoot\System32\Tasks$taskName"

# Check XML file
Test-Path $xmlPath

# Check registry entry (search by Path value)
Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks" |
    Where-Object { $_.GetValue("Path") -eq $taskName } |
    Select-Object PSChildName

# Walk the Tree to find a specific task's GUID
function Get-TaskGuidFromTree {
    param([string]$TaskPath)

    # Build the registry path from the task path
    $regPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree$TaskPath"

    if (Test-Path $regPath) {
        $guid = (Get-Item $regPath).GetValue("Id")
        return $guid
    }
    return $null
}

# Example usage
$guid = Get-TaskGuidFromTree -TaskPath "\Microsoft\Windows\Defrag\ScheduledDefrag"
Write-Output "GUID: $guid"

# Explore all registry values for the ScheduledDefrag task
$treePath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Defrag\ScheduledDefrag"
$guid = (Get-Item $treePath).GetValue("Id")
Write-Output "Task GUID: $guid"

# Read all values from the Tasks entry
$taskPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\$guid"
$taskKey  = Get-Item $taskPath

foreach ($valueName in $taskKey.GetValueNames()) {
    $value = $taskKey.GetValue($valueName)
    $kind  = $taskKey.GetValueKind($valueName)

    if ($kind -eq "Binary") {
        # Display binary values as hex string (first 32 bytes)
        $hex = ($value[0..([Math]::Min(31, $value.Length - 1))] |
            ForEach-Object { '{0:X2}' -f $_ }) -join ' '
        Write-Output "${valueName} ($kind): $hex ..."
    } else {
        Write-Output "${valueName} ($kind): $value"
    }
}

# Decode the DynamicInfo binary structure
function ConvertFrom-DynamicInfo {
    param([byte[]]$Bytes)

    if ($Bytes.Length -lt 28) {
        Write-Warning "DynamicInfo too short ($($Bytes.Length) bytes, expected 28)"
        return
    }

    $version    = [BitConverter]::ToInt32($Bytes, 0)
    $lastRunFt  = [BitConverter]::ToInt64($Bytes, 4)
    $resultCode = [BitConverter]::ToInt32($Bytes, 12)
    $nextRunFt  = [BitConverter]::ToInt64($Bytes, 16)

    # Convert FILETIME to DateTime (0 means never)
    $lastRun = if ($lastRunFt -gt 0) {
        [DateTime]::FromFileTimeUtc($lastRunFt)
    } else { "Never" }

    $nextRun = if ($nextRunFt -gt 0) {
        [DateTime]::FromFileTimeUtc($nextRunFt)
    } else { "Not scheduled" }

    [PSCustomObject]@{
        Version    = $version
        LastRun    = $lastRun
        ResultCode = '0x{0:X8}' -f $resultCode
        NextRun    = $nextRun
    }
}

# Usage: decode DynamicInfo for a specific task
$taskPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\$guid"
$dynInfo  = (Get-Item $taskPath).GetValue("DynamicInfo")
ConvertFrom-DynamicInfo -Bytes $dynInfo

# Compare XML file content with registry Actions value
$taskName = "\Microsoft\Windows\Defrag\ScheduledDefrag"
$xmlPath  = "$env:SystemRoot\System32\Tasks$taskName"

# Read the XML file
[xml]$xmlContent = Get-Content $xmlPath -Encoding UTF8

# Get registry Actions
$guid      = Get-TaskGuidFromTree -TaskPath $taskName
$regPath   = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\$guid"
$regAction = (Get-Item $regPath).GetValue("Actions")

# Display both for comparison
Write-Output "=== XML Command ==="
$xmlContent.Task.Actions.Exec.Command
Write-Output "=== Registry Actions ==="
$regAction

# List all Boot tasks
Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot" |
    ForEach-Object {
        $guid    = $_.PSChildName
        $regPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\$guid"
        if (Test-Path $regPath) {
            [PSCustomObject]@{
                GUID = $guid
                Path = (Get-Item $regPath).GetValue("Path")
            }
        }
    } | Format-Table -AutoSize

# List all Logon tasks with their execution account
Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon" |
    ForEach-Object {
        $guid    = $_.PSChildName
        $regPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\$guid"
        if (Test-Path $regPath) {
            $taskKey = Get-Item $regPath
            [PSCustomObject]@{
                Path = $taskKey.GetValue("Path")
                SD   = $taskKey.GetValue("SecurityDescriptor")
            }
        }
    } | Format-Table -AutoSize

# Extract and display raw trigger data alongside the XML definition
function Compare-TaskTriggers {
    param([string]$TaskPath)

    # Get GUID from Tree
    $treePath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree$TaskPath"
    $guid = (Get-Item $treePath -ErrorAction Stop).GetValue("Id")

    # Registry trigger bytes
    $regPath  = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\$guid"
    $triggers = (Get-Item $regPath).GetValue("Triggers")

    Write-Output "=== Registry Triggers (hex, first 64 bytes) ==="
    $hex = ($triggers[0..([Math]::Min(63, $triggers.Length - 1))] |
        ForEach-Object { '{0:X2}' -f $_ }) -join ' '
    Write-Output $hex

    # XML trigger definition for comparison
    Write-Output "`n=== XML Triggers ==="
    $xmlPath = "$env:SystemRoot\System32\Tasks$TaskPath"
    if (Test-Path $xmlPath) {
        [xml]$xml = Get-Content $xmlPath -Encoding UTF8
        $xml.Task.Triggers.OuterXml | Format-Xml
    }
}

Compare-TaskTriggers -TaskPath "\Microsoft\Windows\Defrag\ScheduledDefrag"

# Read the SDDL of a specific task
$guid    = Get-TaskGuidFromTree -TaskPath "\Microsoft\Windows\Defrag\ScheduledDefrag"
$regPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\$guid"
$sddl    = (Get-Item $regPath).GetValue("SecurityDescriptor")
Write-Output "SDDL: $sddl"

# Convert SDDL to human-readable format
$sd = New-Object System.Security.AccessControl.CommonSecurityDescriptor($true, $false, $sddl)
$sd.DiscretionaryAcl | ForEach-Object {
    $sid     = $_.SecurityIdentifier
    $account = try { $sid.Translate([System.Security.Principal.NTAccount]).Value } catch { $sid.Value }
    [PSCustomObject]@{
        Account    = $account
        AccessMask = '0x{0:X8}' -f $_.AccessMask
        AceType    = $_.AceType
    }
} | Format-Table -AutoSize

# Detect tasks with restrictive security descriptors (potential hidden tasks)
Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks" |
    ForEach-Object {
        $taskKey = $_
        $path    = $taskKey.GetValue("Path")
        $sddl    = $taskKey.GetValue("SecurityDescriptor")

        if ($sddl -and $sddl -match "D:\(D;") {
            # SDDL contains a DENY ACE
            [PSCustomObject]@{
                Path = $path
                SDDL = $sddl
                Note = "Contains DENY ACE - potentially hidden"
            }
        }
    } | Format-Table -AutoSize

# Detect orphaned tasks: present in Tasks but missing from Tree
$taskGuids = (Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks").PSChildName

function Get-TreeGuids {
    param([string]$Path)

    $guids = @()
    $key   = Get-Item $Path -ErrorAction SilentlyContinue
    if ($key) {
        $id = $key.GetValue("Id")
        if ($id) { $guids += $id }
    }

    Get-ChildItem $Path -ErrorAction SilentlyContinue | ForEach-Object {
        $guids += Get-TreeGuids -Path $_.PSPath
    }
    return $guids
}

$treeGuids = Get-TreeGuids -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree"

$orphaned = $taskGuids | Where-Object { $_ -notin $treeGuids }
if ($orphaned) {
    Write-Warning "Orphaned tasks found (present in Tasks, missing from Tree):"
    foreach ($guid in $orphaned) {
        $path = (Get-Item "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\$guid").GetValue("Path")
        Write-Output "  GUID: $guid  Path: $path"
    }
} else {
    Write-Output "No orphaned tasks detected."
}

# WARNING: This is an OFFENSIVE technique shown for educational/detection purposes
# Direct registry task creation bypasses Task Scheduler event logging

$guid     = "{" + [guid]::NewGuid().ToString().ToUpper() + "}"
$taskName = "\Microsoft\Windows\Maintenance\SystemHealthCheck"
$basePath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache"

# Step 1: Create entry in Tasks
$taskKeyPath = Join-Path $basePath "Tasks\$guid"
New-Item -Path $taskKeyPath -Force | Out-Null
Set-ItemProperty -Path $taskKeyPath -Name "Path" -Value $taskName
Set-ItemProperty -Path $taskKeyPath -Name "URI"  -Value $taskName

# Step 2: Create entry in Tree (mimicking a legitimate path)
$treeKeyPath = Join-Path $basePath "Tree$taskName"
New-Item -Path $treeKeyPath -Force | Out-Null
Set-ItemProperty -Path $treeKeyPath -Name "Id" -Value $guid -Type String

# Step 3: Register in a trigger category
$logonPath = Join-Path $basePath "Logon\$guid"
New-Item -Path $logonPath -Force | Out-Null

# Step 4: Create matching XML file for the task to actually run
# (omitted - the XML file is also needed for execution)

# Modify the Actions of an existing task to add a malicious command
# The original task continues to function, but now executes additional code
$guid    = Get-TaskGuidFromTree -TaskPath "\Microsoft\Windows\Defrag\ScheduledDefrag"
$regPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\$guid"

# Read current action
$currentAction = (Get-Item $regPath).GetValue("Actions")
Write-Output "Original action: $currentAction"

# An attacker would modify the XML file in System32\Tasks to add a second Exec block
# and update the Hash value in the registry to match the new XML

# Comprehensive audit: compare registry tasks with XML files on disk
$tasksPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks"

Get-ChildItem $tasksPath | ForEach-Object {
    $guid    = $_.PSChildName
    $path    = $_.GetValue("Path")
    $xmlFile = "$env:SystemRoot\System32\Tasks$path"

    $xmlExists = Test-Path $xmlFile
    $status    = if ($xmlExists) { "OK" } else { "MISSING XML" }

    [PSCustomObject]@{
        GUID      = $guid
        Path      = $path
        XMLExists = $xmlExists
        Status    = $status
    }
} | Where-Object { $_.Status -ne "OK" } | Format-Table -AutoSize

# Query recent task creation and modification events
Get-WinEvent -FilterHashtable @{
    LogName = 'Microsoft-Windows-TaskScheduler/Operational'
    Id      = 106, 140, 141
} -MaxEvents 50 | Select-Object TimeCreated, Id, Message | Format-Table -AutoSize

# Audit all tasks: decode DynamicInfo to find recently executed tasks
Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks" |
    ForEach-Object {
        $taskKey  = $_
        $path     = $taskKey.GetValue("Path")
        $dynInfo  = $taskKey.GetValue("DynamicInfo")

        if ($dynInfo -and $dynInfo.Length -ge 28) {
            $lastRunFt  = [BitConverter]::ToInt64($dynInfo, 4)
            $resultCode = [BitConverter]::ToInt32($dynInfo, 12)

            $lastRun = if ($lastRunFt -gt 0) {
                [DateTime]::FromFileTimeUtc($lastRunFt)
            } else { $null }

            if ($lastRun -and $lastRun -gt (Get-Date).AddDays(-7).ToUniversalTime()) {
                [PSCustomObject]@{
                    Path       = $path
                    LastRun    = $lastRun
                    ResultCode = '0x{0:X8}' -f $resultCode
                }
            }
        }
    } | Sort-Object LastRun -Descending | Format-Table -AutoSize

# Quick diagnostic for a task that won't run
$taskPath = "\Microsoft\Windows\WindowsUpdate\Scheduled Start"
$guid     = Get-TaskGuidFromTree -TaskPath $taskPath
$regPath  = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\$guid"
$dynInfo  = (Get-Item $regPath).GetValue("DynamicInfo")

if ($dynInfo -and $dynInfo.Length -ge 28) {
    $resultCode = [BitConverter]::ToInt32($dynInfo, 12)
    Write-Output "Last result code: 0x$([Convert]::ToString($resultCode, 16).ToUpper().PadLeft(8, '0'))"
} else {
    Write-Output "No DynamicInfo available for this task."
}

# Step 1: Identify the corrupted task
# Look for tasks where registry GUID exists but XML file is missing (or vice versa)
$tasksPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks"

$corruptedTasks = Get-ChildItem $tasksPath | ForEach-Object {
    $guid    = $_.PSChildName
    $path    = $_.GetValue("Path")
    $xmlFile = "$env:SystemRoot\System32\Tasks$path"

    [PSCustomObject]@{
        GUID       = $guid
        Path       = $path
        HasXML     = (Test-Path $xmlFile)
        HasHash    = ($null -ne $_.GetValue("Hash"))
        HasTrigger = ($null -ne $_.GetValue("Triggers"))
    }
} | Where-Object { -not $_.HasXML -or -not $_.HasHash }

$corruptedTasks | Format-Table -AutoSize

# Step 2: Remove a corrupted task entry from the registry
# CAUTION: Backup the registry before proceeding
function Remove-CorruptedTask {
    param(
        [string]$Guid,
        [string]$TaskPath
    )

    $basePath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache"

    # Remove from Tasks
    $taskKeyPath = Join-Path $basePath "Tasks\$Guid"
    if (Test-Path $taskKeyPath) {
        Remove-Item $taskKeyPath -Recurse -Force
        Write-Output "Removed from Tasks: $Guid"
    }

    # Remove from Tree
    $treeKeyPath = Join-Path $basePath "Tree$TaskPath"
    if (Test-Path $treeKeyPath) {
        Remove-Item $treeKeyPath -Recurse -Force
        Write-Output "Removed from Tree: $TaskPath"
    }

    # Remove from trigger category subtrees
    foreach ($category in @("Boot", "Logon", "Maintenance", "Plain")) {
        $catPath = Join-Path $basePath "$category\$Guid"
        if (Test-Path $catPath) {
            Remove-Item $catPath -Recurse -Force
            Write-Output "Removed from ${category}: $Guid"
        }
    }

    Write-Output "Cleanup complete. Restart the Schedule service to apply changes."
}

# Example usage (replace with actual GUID and path)
# Remove-CorruptedTask -Guid "{A1B2C3D4-...}" -TaskPath "\MyCompany\BrokenTask"

# Step 3: Re-import from XML (if the XML file still exists)
# Or recreate the task from scratch
$xmlFile = "$env:SystemRoot\System32\Tasks\Microsoft\Windows\Defrag\ScheduledDefrag"
if (Test-Path $xmlFile) {
    schtasks /create /tn "\Microsoft\Windows\Defrag\ScheduledDefrag" /xml $xmlFile /f
    Write-Output "Task re-imported from XML file."
} else {
    Write-Output "No XML file found. Task must be recreated manually."
}

# Check the Schedule service registry configuration
$svcPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Schedule"

[PSCustomObject]@{
    Start        = (Get-ItemProperty $svcPath).Start
    Type         = (Get-ItemProperty $svcPath).Type
    ImagePath    = (Get-ItemProperty $svcPath).ImagePath
    ErrorControl = (Get-ItemProperty $svcPath).ErrorControl
    Group        = (Get-ItemProperty $svcPath).Group
} | Format-List

# Reset the Schedule service to automatic start
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Schedule" -Name "Start" -Value 2

# Restart the service
Restart-Service Schedule -Force

# Verify the integrity of the Task Scheduler service DLL
sfc /verifyfile="%SystemRoot%\system32\schedsvc.dll"

# Quick comparison: Get-ScheduledTask vs registry enumeration
$apiCount = (Get-ScheduledTask).Count
$regCount = (Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks").Count

Write-Output "Tasks via API:      $apiCount"
Write-Output "Tasks in registry:  $regCount"

if ($regCount -ne $apiCount) {
    Write-Warning "Mismatch detected! $($regCount - $apiCount) tasks exist only in the registry."
}