API Reference
ScheduledTaskInfo
Representation of a Windows Scheduled Task focused on Exec actions. When suspicion enrichment is enabled at query time, the IsSuspicious and related fields are populated to aid detection and reporting.
Inheritance
- Object
- ScheduledTaskInfo
Constructors
public ScheduledTaskInfo() #Inherited Methods
public override Boolean Equals(Object obj) #BooleanParameters
- obj Object
Properties
public String Name { get; set; } #Task display name (not including folder path).
public String Path { get; set; } #Full task path (e.g., \Microsoft\Windows\Defender\MpScheduledScan).
public String Command { get; set; } #Executable path of the first Exec action.
public String Arguments { get; set; } #Arguments for the first Exec action.
public Boolean Enabled { get; set; } #Whether the task is enabled.
public Nullable<DateTime> LastRunTime { get; set; } #Last run time as reported by the scheduler; may be null.
public Nullable<DateTime> NextRunTime { get; set; } #Next scheduled run time; may be null.
public String RunAsUser { get; set; } #Account the task runs as (e.g., SYSTEM, DOMAIN\User, DOMAIN\gmsa$).
public String RunAsLogonType { get; set; } #Task logon type as reported by the scheduler (e.g., ServiceAccount, S4U, Password, InteractiveToken).
public Nullable<Boolean> RunAsIsSystem { get; set; } #True when the principal resolves to SYSTEM/NT AUTHORITY\\SYSTEM.
public Nullable<Boolean> RunAsIsGmsa { get; set; } #True when the principal appears to be a Group Managed Service Account (ends with '$') and uses ServiceAccount logon.
public Nullable<Boolean> IsSuspicious { get; set; } #Suspicious flag computed by ComputerX heuristics when requested. null when not evaluated.
public Nullable<Int32> SuspicionScore { get; set; } #Suspicion score (0..N). null when not evaluated.
public IReadOnlyList<String> SuspicionReasons { get; set; } #Human-readable reasons that contributed to the suspicion score (optional).
public IReadOnlyList<String> SuspicionTags { get; set; } #Short tags for quick filtering (e.g., OutsideRoots, EncodedArgs).
public String SuspicionVersion { get; set; } #Heuristics version string to help correlate results across runs.