Windows Privileged Scheduled Task & Service Discovery Tool for fun and profit.
TaskHound hunts for Windows scheduled tasks and services running with privileged accounts and stored credentials. It enumerates tasks over SMB, discovers domain-account services via SVCCTL RPC, and identifies high-value attack opportunities through BloodHound integration.
For the full backstory (and the questionable life choices that led here): Part 1 and Part 2.
# Install
git clone https://github.com/1r0BIT/TaskHound.git
cd TaskHound
python3 -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"
# Basic scan — tasks only
taskhound -u cloud.strife -p 'Buster$word97!' -d shinra.local -t reactor01.shinra.local
# Tasks + services (discovers domain-account services too)
taskhound -u cloud.strife -p 'Buster$word97!' -d shinra.local -t reactor01.shinra.local --services
# Services only (skip task enumeration)
taskhound -u cloud.strife -p 'Buster$word97!' -d shinra.local -t reactor01.shinra.local --services-only
# Auto-discover all domain computers, 20 threads
taskhound -u cloud.strife -p 'Buster$word97!' -d shinra.local --dc-ip 10.0.0.1 --auto-targets --threads 20
# Full stealth mode
taskhound -u cloud.strife -p 'Buster$word97!' -d shinra.local -t reactor01.shinra.local --opsec --jitter 5| Feature | Description |
|---|---|
| Scheduled Task Discovery | Enumerates tasks over SMB, parses XMLs, identifies stored credentials |
| Windows Service Discovery | Discovers Windows services running as domain accounts via SVCCTL RPC |
| Tier-0 & PRIV Detection | Identifies tasks/services running as Domain Admins, Enterprise Admins, high-value targets |
| BloodHound OpenGraph | Visualize tasks and services as attack path nodes in BloodHound CE |
| LSA Secret Extraction | Registry-only credential extraction (no disk writes) for service passwords + DPAPI keys |
| DPAPI Auto-Decryption | Automatically extracts DPAPI system key and decrypts stored task credentials |
| LAPS Integration | Auto-retrieve LAPS passwords (Windows LAPS + Legacy) for per-host authentication |
| Credential Validation | Checks if stored task passwords are still valid via RPC heuristics |
| Multi-threaded Scanning | Parallel target processing with rate limiting and jitter for OPSEC |
| Offline Analysis | Process mounted disk images, collected XMLs, or exported registry hives |
| Multiple Output Formats | Plain text, JSON, CSV, and HTML security reports |
| SID Resolution | Multi-tier chain: BloodHound → Cache → LSARPC → LDAP → Global Catalog |
The README used to be 750 lines. It was getting out of hand. Here's where everything lives now:
| Guide | What's in it |
|---|---|
| Getting Started | Installation, first scan, what to expect |
| Authentication | Password, NTLM hash, Kerberos, AES keys, LAPS |
| Service Enumeration | --services flag, SVCCTL, gMSA detection, classification |
| BloodHound Integration | BHCE setup, OpenGraph nodes/edges, Cypher queries |
| Loot & Credentials | LSA extraction, DPAPI, --loot, --no-lsa, credential validation |
| Output Formats | Plain/JSON/CSV/HTML, directory structure |
| OPSEC | Detection surface, --opsec, per-protocol disable flags |
| Configuration | TOML config files, precedence, environment variables |
| Offline Analysis | --offline, --offline-disk, registry hive parsing |
| Advanced Usage | Threading, auto-targets, SID resolution, caching, BOF |
TaskHound's BOF is included in the Adaptix Extension-Kit under SAR-BOF/taskhound/.
When caffeine intake and free time align:
- Modularization of Stages: This turned into a behemoth with way too many switches. I'll fix that.
- Abuse Info Integration: MITRE ATT&CK techniques in BloodHound nodes
- Custom Tier-0 Mappings: Support for user-defined privilege zones in BHCE
- Fortra/Impacket - SMB/RPC/Kerberos, DPAPI-NG, MS-GKDI, regsecrets
- SpecterOps/BloodHound - Attack path analysis
- Podalirius/bh-opengraph - OpenGraph inspiration
- Pennyw0rth/NetExec - LAPS implementation reference
- jborean93/dpapi-ng - DPAPI-NG research
- tijldeneut/DPAPIck3 - DPAPI decryption reference
- gentilkiwi/mimikatz - DPAPI research
- Synacktiv - Registry-only LSA extraction research
- Jonas Bülow Knudsen (@Jonas_B_K) - Inspiration for Windows service enumeration
And everyone who contributed to making offensive security tooling accessible.
TaskHound is strictly an audit and educational tool. Use only in environments you own or have explicit authorization to test. Seriously. Don't be a jerk.
PRs welcome. Half of this was caffeine-induced vibe-coding, so don't expect miracles.
Use responsibly. No warranty provided. See LICENSE for details.