Cortex XDR Pro - Looking for Scheduled tasks by name in mass?

[RFeyertag]

Hello dear community, 

here is a script for searching specific scheduled tasks by name in mass. The search is via LIKE and wildcards are used. 

import subprocess
import sys

def ScheduledTask(scheduler_name):
    # PowerShell-Befehl mit Where-Object und Filterung für den TaskScheduler
    pscommand = f"""Get-ScheduledTask | Where-Object {{$_.TaskName -like '*{scheduler_name}*'}} | ForEach-Object {{ $_.TaskName + "|" + $_.State }}"""
    try:
        # PowerShell-Befehl ausführen und Ausgabe erfassen
        result = subprocess.check_output(["powershell", "& {" + pscommand + "}"], text=True, encoding='utf-8', errors='ignore')
      
        # Ergebnis anzeigen oder weiterverarbeiten
        return result.strip()

    except subprocess.CalledProcessError as e:
        # Fehlerbehandlung, falls der Befehl nicht erfolgreich ist
        sys.stderr.write(f"Fehler bei der Ausführung des Befehls: {e}")
        return None

# Vorherige Festlegung des TaskScheduler-Namens
scheduler_name = "MeinTaskScheduler"

# Aufruf der Funktion mit dem festgelegten TaskScheduler-Namen
output = ScheduledTask(scheduler_name)

# Ausgabe des Ergebnisses ohne Header
print(output)

Have fun with it! 

BR

Rob

[jmazzeo · Accepted solution]

Thanks for sharing!

[RFeyertag]

You're welcome 🙂

[Frank-Bussink]

Hi,

i took the liberty to use your code and to evolve it, by passing the scheduler_name as an argument of the script

import subprocess
import sys

def ScheduledTask(scheduler_name):
    # PowerShell command using Where-Object and filtering for the TaskScheduler
    pscommand = f"""Get-ScheduledTask | Where-Object {{$_.TaskName -like '*{scheduler_name}*'}} | ForEach-Object {{ $_.TaskName + "|" + $_.State }}"""
    try:
        # Execute PowerShell command and capture output
        result = subprocess.check_output(["powershell", "& {" + pscommand + "}"], text=True, encoding='utf-8', errors='ignore')
      
        # Display or further process the result
        return result.strip()

    except subprocess.CalledProcessError as e:
        # Error handling if the command is not successful
        sys.stderr.write(f"Error executing the command: {e}")
        return None


if __name__ == "__main__":
    print(main(sys.argv[1]))