dissect.target.plugins.os.windows.log.schedlgu
#
Module Contents#
Classes#
Plugin for parsing the Task Scheduler Service transaction log file (SchedLgU.txt). |
Attributes#
- dissect.target.plugins.os.windows.log.schedlgu.log#
- dissect.target.plugins.os.windows.log.schedlgu.SchedLgURecord#
- dissect.target.plugins.os.windows.log.schedlgu.JOB_REGEX_PATTERN#
- dissect.target.plugins.os.windows.log.schedlgu.SCHEDLGU_REGEX_PATTERN#
- class dissect.target.plugins.os.windows.log.schedlgu.SchedLgU#
- ts: datetime.datetime#
- job: str#
- status: str#
- command: str#
- exit_code: int#
- version: str#
- class dissect.target.plugins.os.windows.log.schedlgu.SchedLgUPlugin(target: dissect.target.Target)#
Bases:
dissect.target.plugin.Plugin
Plugin for parsing the Task Scheduler Service transaction log file (SchedLgU.txt).
- PATHS#
- check_compatible() None #
Perform a compatibility check with the target.
This function should return
None
if the plugin is compatible with the current target (self.target
). For example, check if a certain file exists. Otherwise it should raise anUnsupportedPluginError
.- Raises:
UnsupportedPluginError – If the plugin could not be loaded.
- schedlgu() Iterator[SchedLgURecord] #
Return all events in the Task Scheduler Service transaction log file (SchedLgU.txt).
Older Windows systems may log
.job
tasks that get started remotely in the SchedLgU.txt file. In addition, this log file records when the Task Scheduler service starts and stops.Adversaries may use malicious
.job
files to gain persistence on a system.- Yields:
ts (datetime) – The timestamp of the event. job (str): The name of the
.job
file. command (str): The command executed. status (str): The status of the event (finished, completed, exited, stopped). exit_code (int): The exit code of the event. version (str): The version of the Task Scheduler service.