Created
December 23, 2025 18:33
-
-
Save ahhh/cdf77685e4c9e9904cf226110e141100 to your computer and use it in GitHub Desktop.
Quick and dirty arbitrary scheduled task parser
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Define the task folder path | |
| $taskFolder = "C:\Windows\System32\Tasks\" | |
| # Get all tasks in that folder and its subfolders | |
| $tasks = Get-ScheduledTask | Where-Object { $_.TaskPath -like "\*" } | |
| if ($tasks.Count -eq 0) { | |
| Write-Warning "No tasks found. Try running PowerShell as Administrator." | |
| } | |
| foreach ($task in $tasks) { | |
| # Tasks can have multiple actions, so we loop through them | |
| foreach ($action in $task.Actions) { | |
| # We only care about "Execute" actions (CMD/Programs) | |
| if ($action.Id -eq $null -or $action.PSChildName -eq "Execute") { | |
| [PSCustomObject]@{ | |
| TaskName = $task.TaskName | |
| Path = $task.TaskPath | |
| Command = $action.Execute | |
| Arguments = $action.Arguments | |
| } | |
| } | |
| } | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment