.. / Get-ScheduledTask

Gets the task definition object of a scheduled task that is registered on the local computer

Processes

List details on scheduled tasks

Get-ScheduledTask -CimSession $s | % { [PSCustomObject]@{State=$_.State; TaskName=$_.TaskName; TaskPath=$_.TaskPath; Actions=$($a=$_.Actions;$($a.Id,$a.WorkingDirectory,$a.Execute,$a.Arguments).Where({$_ -ne $null}) -join " "); Author=$_.Author; Description=$_.Description; SecurityDescriptor=$_.SecurityDescriptor } }

• Create CimSession $s using New-CimSession
• PowerShell Module: ScheduledTasks

• T1053.005
• T1047