Skip to content

Adds a new LiveResponse module wrapping NirSoft's TaskSchedulerView - #1117

Merged
AndrewRathbun merged 1 commit into
EricZimmerman:masterfrom
Gear-I:NirSoft_TaskScheduler_View
Sep 15, 2026
Merged

AndrewRathbun merged 1 commit into
EricZimmerman:masterfrom
Gear-I:NirSoft_TaskScheduler_View

Conversation

@Gear-I

@Gear-I Gear-I commented Sep 15, 2026 •

Copy link
Copy Markdown
Contributor

Description

Adds a new LiveResponse module wrapping NirSoft's TaskSchedulerView to export the live state of Windows Task Scheduler tasks to CSV.
Verified directly against NirSoft's [own documentation, ask SchedulerView's /LoadFrom switch only supports ](documentation: SchedulerView's/LoadFrom switch supports only)1 (local machine) or 2 (remote computer); there's no offline/folder-load mode, so this can't process already-collected data the way most modules do.

Target: that Target collects the raw .xml task definitions from C:\Windows\System32\Tasks, which show how a task is defined but not its live runtime state. This module adds that missing piece: last run result, next scheduled run, current enabled/disabled status in a single readable CSV.

Testing: downloaded the real binary, ran it live via kape.exe --msource C: --mdest --module NirSoft_TaskSchedulerViewer --debug against my own machine, and got a real CSV back with 268 actual scheduled tasks and full detail per task (status, last/next run, triggers, executable, running account, etc.) — not a synthetic or empty test.

No existing module in the repo covers this tool.

Checklist:

Please replace every instance of [ ] with [X] OR click on the checkboxes after you submit your PR

  • I have generated a unique GUID for my Target(s)/Module(s)
  • I have placed the Target(s)/Module(s) in an appropriate subfolder in Targets or Modules. If one doesn't exist, I have either added it to the Misc folder or created a relevant subfolder with justification
  • I have set or updated the version of my Target(s)/Module(s)
  • I have verified that KAPE parses the Target(s)/Module(s) successfully via kape.exe, using --tlist/--mlist and corrected any errors
  • I have validated my Target(s)/Module(s) against test data and verified they are working as intended
  • I have made an attempt to document the artifacts within the Target(s) or Module(s) I am submitting. If documentation doesn't exist, I have placed N/A underneath the Documentation header
  • For Targets, I have consulted either the Target Guide, Target Template, Compound Target Guide, or Compound Target Template to ensure my Target(s) follow the same format
  • For Modules, I have consulted either the Module Guide, Module Template, Compound Module Guide, or Compound Module Template to ensure my Module(s) follow the same format

@AndrewRathbun AndrewRathbun self-assigned this Sep 15, 2026
@AndrewRathbun AndrewRathbun added the enhancement New feature or request label Sep 15, 2026
@AndrewRathbun
AndrewRathbun merged commit b8c2f58 into EricZimmerman:master Sep 15, 2026
1 check passed
@Gear-I
Gear-I deleted the NirSoft_TaskScheduler_View branch September 15, 2026 19:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants