Scheduled Tasks

[coreymaygard]

Description: looks for existing scheduled tasks that exist on a windows host

What The Data Shows: shows what tasks are running, scheduled tasks are often used as a method of persistence for an attacker. also could be used for compliance, to make sure no users are running automated tasks they should not be.

SQL: 

SELECT name,action,path,state,
    datetime(last_run_time,"unixepoch","localtime") AS last_run_time
FROM (`scheduled_tasks`) 
ORDER BY last_run_time DESC;

[jnelson]

@coreymaygard would you consider converting the last_run_time and then sorting by by the time? Here is an example:

SELECT name,action,path,state,
    datetime(last_run_time,"unixepoch","localtime") AS last_run_time
FROM (`scheduled_tasks`)
ORDER BY last_run_time DESC;

[coreymaygard]

I added in your suggestion, thanks Jnelson