Scheduled Task Cache
The registry side of every scheduled task, which you cross check against the XML.
Use it to find every registered scheduled task and its actions, including a task hidden from Task Scheduler.
- SOFTWARE
- Persistence
What It Is
Task Scheduler runs programs automatically when triggers you choose are met, such as a set time, system startup or a user signing in. The TaskCache key is where the Task Scheduler service keeps the registry record of each task. A subkey under Tree exists for every task, with an Id value that links to the task's XML file in C:\Windows\System32\Tasks. It lives in HKLM SOFTWARE.
What It Proves
A task under TaskCache Tree has an Id that links to a Tasks subkey holding its actions and triggers. Together they prove a scheduled task is registered to run a command.
What It Does Not Prove
The action is stored as packed binary, so read the matching XML file in System32 Tasks for clarity. A Tree key with no SD value is hidden from schtasks and Task Scheduler. A Tree entry with no Tasks match, or a task file with no registry entry, is suspicious too.
Where It Lives
Scheduled Task Cache lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SOFTWARE\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| WindowsUpdateHelper, a task at the Tree root, was last written 12 Oct 2026 10:06 UTC. That is the minute updsvc64 |
| Decoded, the Exec action runs C:\ |
| The task still has its SD value, so schtasks and Task Scheduler list it and it was not hidden. A Tree entry without SD is the hidden kind to hunt. |
How to Read It
Find the task under TaskCache Tree, read its Id GUID and check that it still has an SD value. Open TaskCache Tasks under that GUID for the Actions, Triggers and the path of the XML. Compare with the XML file under C:\Windows\System32\Tasks for the full command.
- When Windows Writes It
- When a task is created, changed or deleted.
- Which Windows Versions
- Windows 7 to 11
- Tools That Parse It
- Registry Explorer, RECmd, Autoruns
Hunt It
Defender records these writes, but the Task Scheduler service usually makes them, so the account shown is not the requester. A hit shows a task registered, not that it ran. Read the task XML for the command.
// New entries under the scheduled task cacheDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Scheduled Task Cache shows.
- AmcacheGives the SHA-1 of the program the task runs, to check it after it has gone.
- Task XML in System32 TasksNot in the RegistryGives the task's command in plain text. A mismatch with the key is a warning sign.
- Scheduled Task Created, Security Event 4698Not in the RegistryDates when the task was created, and by which account, if auditing is on.
Sources
The facts on this page come from these public pages, which say more on each point.
- Microsoft Learn: Scheduled Tasks Fail with Error Task Schedular Service Is Not Available (opens in a new tab)
- MITRE ATT&CK T1053.005: Scheduled Task/Job: Scheduled Task (opens in a new tab)
- Microsoft Security: Tarrask hides scheduled tasks (opens in a new tab)
- Sysinternals Autoruns (opens in a new tab)