Scheduled Task Trigger Analysis

[JasonWalker]

Here’s a similar case of parsing scheduled task XML if it helps

Schedule Task search & delete

You can look at xml of scheduled task to get the details and parse it using the XML inspectors. Here’s an example I’m using Here’s a search for a scheduled task “My Task Name” with an action pointing to c:\Windows\myscript.cmd: (not exists scheduled tasks "My Task Name" whose (exists (node values of child nodes of xpaths ("xmlns:t='http://schemas.microsoft.com/windows/2004/02/mit/task'", "/t:Task/t:Actions/t:Exec/t:Command") of xml document of xml of it) whose (it = "%22" & pathname of window…