Bert-JanP / Incident-Response-Powershell

PowerShell Digital Forensics & Incident Response Scripts.
BSD 3-Clause "New" or "Revised" License
434 stars 60 forks source link

Scheduled Tasks Section #12

Open colesmith2344 opened 1 week ago

colesmith2344 commented 1 week ago

Ive been working on editing the script to try and have less noise in the scheduled task section. My idea is to only pull newly created or modified within the last 7 days. However, I can't seem to get it to see anything when it runs although I know I created a new reg key right before I tried. Does the below function that I modified make any sense or am I banging my head against a wall?

function Get-ScheduledTasks { Write-Host "Collecting Scheduled Tasks..." $ScheduledTaskFolder = "$FolderCreation\ScheduledTask" mkdir -Force $ScheduledTaskFolder| Out-Null $daysAgo = (Get-Date).AddDays(-7) $ProcessOutput = "$ScheduledTaskFolder\ScheduledTasksList.txt" Get-ScheduledTask | Where-Object { ($.LastRunTime -ge $daysAgo) -or ($.NextRunTime -ge $daysAgo) } | Format-List | Out-File -Force -FilePath $ProcessOutput }

colesmith2344 commented 1 week ago

I also tried to use the $sw parameter but make me put in the value of it even though it should be pointing back to the value of two the others.

function Get-ScheduledTasks { param( [Parameter(Mandatory=$true)][String]$sw ) Write-Host "Collecting Scheduled Tasks..." $ScheduledTaskFolder = "$FolderCreation\ScheduledTask" mkdir -Force $ScheduledTaskFolder| Out-Null $ProcessOutput = "$ScheduledTaskFolder\ScheduledTasksList.txt" Get-ScheduledTask -After (Get-Date).AddDays(-$sw) | Where-Object {$_.State -ne "Disabled"} | Format-List | Out-File -Force -FilePath $ProcessOutput }