CompTIA CySA+ (CS0-003)Incident Response and ManagementMedium
A security analyst is investigating a potential compromise on a Windows server. The analyst suspects that an attacker may have established persistence by creating scheduled tasks that execute malicious scripts. The analyst needs to identify these scheduled tasks to remove them. Which of the following command-line utilities or locations would be MOST effective for listing and examining scheduled tasks on a Windows system?
- AEvent Viewer (eventvwr.msc)
- BTask Scheduler (taskschd.msc)
- CRegedit (Registry Editor)
- Dservices.msc
Show answer & explanationAnswer & explanation
Correct answer: B. Task Scheduler (taskschd.msc)
Task Scheduler (taskschd.msc) or its command-line equivalent 'schtasks' is the primary and most effective utility for managing, listing, and examining scheduled tasks on a Windows system. It provides a comprehensive view of all defined tasks, their triggers, and actions.
Why the other options are wrong
- A. Event Viewer shows logs, not the scheduled tasks themselves.
- C. Regedit can show some task-related entries but is not the primary or most effective way to manage or view them comprehensively.
- D. services.msc manages background services, not scheduled tasks.
Windows Scheduled Tasks
A Windows operating system feature that allows users to schedule programs or scripts to run at predetermined times or when a specific system event occurs, often abused by attackers for persistence.
- Managed via Task Scheduler (taskschd.msc) or 'schtasks' command.
- Can execute programs, scripts, or send alerts.
- Attackers use them to ensure malware re-executes after reboots.
Memory trick: Run, Start, Schedule, Inject