volatility3.plugins.windows.scheduled_tasks module

class ActionSet(actions, context)[source]

Bases: object

actions: List[TaskAction]

context: Optional[str]

classmethod decode(data)[source]

Return type:: Optional[ActionSet]

class ActionType(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)[source]

Bases: Enum

Enumeration that maps action types to their magic number encodings

ComHandler = 30583

Email = 34952

Exe = 26214

MessageBox = 39321

class DynamicInfo(creation_time, last_run_time, last_successful_run_time, last_error_code)[source]

Bases: object

Contains information about execution history for this task, including timestamps and the last error code

creation_time: Optional[datetime]

classmethod decode(data)[source]

Decodes a DynamicInfo structure from RegBin value data. Raises a ScheduledTaskDecodingError if the magic bytes are invalid, but otherwise attempts to decode as much as possible without returning an error.

Return type:: Optional[DynamicInfo]

last_error_code: Optional[int]

last_run_time: Optional[datetime]

last_successful_run_time: Optional[datetime]

class JobBucket(flags, crc32, principal_id, display_name, user_info, optional_settings)[source]

Bases: object

crc32: int

display_name: Optional[str]

flags: List[str]

optional_settings: Optional[OptionalSettings]

principal_id: Optional[str]

user_info: Optional[UserInfo]

class Months(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)[source]

Bases: Enum

Enumeration that contains bitwise values for months of the year.

April = 8

August = 128

December = 2048

February = 2

January = 1

July = 64

June = 32

March = 4

May = 16

November = 1024

October = 512

September = 256

class OptionalSettings(IdleDurationSeconds, idleWaitTimeoutSeconds, ExecutionTimeLimitSeconds, DeleteExpiredTaskAfter, Priority, RestartOnFailureDelay, RestartOnFailureRetries, NetworkId, Privileges, Periodicity, Deadline, Exclusive)[source]

Bases: object

Deadline: Optional[TaskSchedulerTimePeriod]

DeleteExpiredTaskAfter: int

Exclusive: Optional[bool]

ExecutionTimeLimitSeconds: int

IdleDurationSeconds: int

NetworkId: bytes

Periodicity: Optional[TaskSchedulerTimePeriod]

Priority: int

Privileges: Optional[List[str]]

RestartOnFailureDelay: int

RestartOnFailureRetries: int

idleWaitTimeoutSeconds: int

class Privileges(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)[source]

Bases: Enum

SeAssignPrimaryTokenPrivilege = 8

SeAuditPrivilege = 2097152

SeBackupPrivilege = 131072

SeChangeNotifyPrivilege = 8388608

SeCreateGlobalPrivilege = 1073741824

SeCreatePagefilePrivilege = 32768

SeCreatePermanentPrivilege = 65536

SeCreateSymbolicLinkPrivilege = 34359738368

SeCreateTokenPrivilege = 4

SeDebugPrivilege = 1048576

SeDelegateSessionUserImpersonatePrivilege = 68719476736

SeEnableDelegationPrivilege = 134217728

SeImpersonatePrivilege = 536870912

SeIncreaseBasePriorityPrivilege = 16384

SeIncreaseQuotaPrivilege = 32

SeIncreaseWorkingSetPrivilege = 8589934592

SeLoadDriverPrivilege = 1024

SeLockMemoryPrivilege = 16

SeMachineAccountPrivilege = 64

SeManageVolumePrivilege = 268435456

SeProfileSingleProcessPrivilege = 8192

SeRelabelPrivilege = 4294967296

SeRemoteShutdownPrivilege = 16777216

SeRestorePrivilege = 262144

SeSecurityPrivilege = 256

SeShutdownPrivilege = 524288

SeSyncAgentPrivilege = 67108864

SeSystemEnvironmentPrivilege = 4194304

SeSystemProfilePrivilege = 2048

SeSystemtimePrivilege = 4096

SeTakeOwnershipPrivilege = 512

SeTcbPrivilege = 128

SeTimeZonePrivilege = 17179869184

SeTrustedCredManAccessPrivilege = 2147483648

SeUndockPrivilege = 33554432

class ScheduledTasks(context, config_path, progress_callback=None)[source]

Bases: PluginInterface, TimeLinerInterface

Decodes scheduled task information from the Windows registry, including information about triggers, actions, run times, and creation times.

Parameters:

context (ContextInterface) – The context that the plugin will operate within
config_path (str) – The path to configuration data within the context configuration data
progress_callback (Optional[Callable[[float, str], None]]) – A callable that can provide feedback at progress points

build_configuration()

Constructs a HierarchicalDictionary of all the options required to build this component in the current context.

Ensures that if the class has been created, it can be recreated using the configuration built Inheriting classes must override this to ensure any dependent classes update their configurations too

Return type:: HierarchicalDict

property config: HierarchicalDict: The Hierarchical configuration Dictionary for this Configurable object.

property config_path: str: The configuration path on which this configurable lives.

property context: ContextInterface: The context object that this configurable belongs to/configuration is stored in.

generate_timeline()[source]

Method generates Tuples of (description, timestamp_type, timestamp)

These need not be generated in any particular order, sorting will be done later

Return type:: Iterator[Tuple[str, TimeLinerType, datetime]]

classmethod get_requirements()[source]

Returns a list of Requirement objects for this plugin.

Return type:: List[RequirementInterface]

classmethod get_software_hive(context, config_path, kernel)[source]

Retrieves the Amcache.hve registry hive from the kernel module, if it can be located.

Return type:: Optional[RegistryHive]

classmethod make_subconfig(context, base_config_path, **kwargs)

Convenience function to allow constructing a new randomly generated sub-configuration path, containing each element from kwargs.

Parameters:

context (ContextInterface) – The context in which to store the new configuration
base_config_path (str) – The base configuration path on which to build the new configuration
kwargs – Keyword arguments that are used to populate the new configuration path

Returns:

The newly generated full configuration path

Return type:

str

property open: Returns a context manager and thus can be called like open

classmethod parse_actions_value(actions_value)[source]

Parses File entries from the Windows 8 RootFile key.

Parameters:: programs_key – The RootFile registry key.
Return type:: Optional[ActionSet]
Returns:: An iterator of tuples, where the first member is the program ID string for

correlating RootProgram entries, and the second member is the AmcacheEntry.

classmethod parse_dynamic_info_value(dyn_info_value)[source]

Return type:: Optional[DynamicInfo]

classmethod parse_triggers_value(triggers_value)[source]

Return type:: Optional[TriggerSet]

run()[source]

Executes the functionality of the code.

Note

This method expects self.validate to have been called to ensure all necessary options have been provided

Returns:: A TreeGrid object that can then be passed to a Renderer.

set_open_method(handler)

Sets the file handler to be used by this plugin.

Return type:: None

classmethod unsatisfied(context, config_path)

Returns a list of the names of all unsatisfied requirements.

Since a satisfied set of requirements will return [], it can be used in tests as follows:

unmet = configurable.unsatisfied(context, config_path)
if unmet:
    raise RuntimeError("Unsatisfied requirements: {}".format(unmet)

Return type:: Dict[str, RequirementInterface]

version = (1, 0, 0)

class SessionState(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)[source]

Bases: Enum

ConsoleConnect = 1

ConsoleDisconnect = 2

RemoteConnect = 3

RemoteDisconnect = 4

SessionLock = 5

SessionUnlock = 6

Unknown = 'Unknown'

class SidType(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)[source]

Bases: Enum

Enumeration that maps SID types to their encoded integer values

Alias = 4

Computer = 9

DeletedAccount = 6

Domain = 3

Group = 2

Invalid = 7

Label = 10

LogonSession = 11

Unknown = 8

User = 1

WellKnownGroup = 5

class TaskAction(action_type, action, action_args, working_directory)[source]

Bases: object

action: str

action_args: Optional[str]

action_type: ActionType

classmethod decode_messagebox_action(reader)[source]

Return type:: Optional[TaskAction]

working_directory: Optional[str]

class TaskSchedulerTimePeriod(years, months, weeks, days, hours, minutes, seconds)[source]

Bases: object

Class containing information delimiting time periods within scheduled tasks.

days: int

hours: int

minutes: int

months: int

seconds: int

weeks: int

years: int

class TaskTrigger(start_boundary, end_boundary, repetition_interval_seconds, enabled, trigger_type, description)[source]

Bases: object

description: Optional[str]

enabled: Optional[bool]

end_boundary: Optional[datetime]

repetition_interval_seconds: Optional[int]

start_boundary: Optional[datetime]

trigger_type: TriggerType

class TimeMode(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)[source]

Bases: Enum

Enumeration containing the different time modes that a ‘Time’ trigger can be configured to run in.

Daily = 'Daily'

DaysInMonths = 'Days In Months'

DaysInWeeksInMonths = 'Days In Weeks in Months'

Once = 'Once'

Unknown = 'Unknown'

Weekly = 'Weekly'

class TriggerSet(job_bucket, triggers)[source]

Bases: object

classmethod decode(data)[source]

Return type:: Optional[TriggerSet]

job_bucket: JobBucket

triggers: List[TaskTrigger]

class TriggerType(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)[source]

Bases: Enum

Enumeration that maps trigger types to their magic number encodings

Boot = 65535

Event = 52428

Idle = 61166

Logon = 43690

Registration = 34952

Session = 30583

Time = 56797

WindowsNotificationFacility = 26214

class UserInfo(sid_type, sid, username)[source]

Bases: object

sid: Optional[str]

sid_type: Optional[SidType]

username: Optional[str]

class Weekday(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)[source]

Bases: Enum

Enumeration that contains bitwise values for days of the week.

Friday = 32

Monday = 2

Saturday = 64

Sunday = 1

Thursday = 16

Tuesday = 4

Wednesday = 8

decode_sid(data)[source]

Decodes a windows SID from variable-length raw bytes

Returns the string representation of the SID if decoding was successful, or None if the data could not be parsed due to an insufficent number of bytes.

Return type:: Optional[str]