From 2df991cc7221848410d7d30146e59b4b425fc6a8 Mon Sep 17 00:00:00 2001 From: joao Date: Thu, 19 Feb 2026 13:21:07 +0000 Subject: [PATCH] fix: handle ScheduleByWeek without WeeksInterval in CalendarTrigger Resolves ValueError('Unknown calendar type') when parsing Windows Task XML with ScheduleByWeek triggers that omit the WeeksInterval element. This occurs in real-world exported/UTF-16 task XML files. The fix: - Detect ScheduleByWeek directly (not gated on WeeksInterval presence) - Default weeks_between_triggers to 1 when WeeksInterval is missing - Safely extract DaysOfWeek children (handle missing elements gracefully) --- dissect/target/plugins/os/windows/tasks/xml.py | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/dissect/target/plugins/os/windows/tasks/xml.py b/dissect/target/plugins/os/windows/tasks/xml.py index 6716ab9a8d..9589c7e849 100644 --- a/dissect/target/plugins/os/windows/tasks/xml.py +++ b/dissect/target/plugins/os/windows/tasks/xml.py @@ -318,10 +318,19 @@ def get_triggers(self) -> Iterator[GroupedRecord]: days_between_triggers=int(days_between_triggers), ) - elif weeks_between_triggers := self.get_element("ScheduleByWeek/WeeksInterval", trigger): - days_of_week = [day.tag for day in trigger.find("ScheduleByWeek/DaysOfWeek/").iter("*")] + elif trigger.find("ScheduleByWeek/") is not None: + weeks_between_triggers = self.get_element("ScheduleByWeek/WeeksInterval", trigger) + # If WeeksInterval is not present, default to 1 (every week). + weeks_between_triggers = int(weeks_between_triggers) if weeks_between_triggers else 1 + + days_el = trigger.find("ScheduleByWeek/DaysOfWeek") + if days_el is not None: + days_of_week = [day.tag for day in list(days_el)] + else: + days_of_week = [] + record = WeeklyTriggerRecord( - weeks_between_triggers=int(weeks_between_triggers), + weeks_between_triggers=weeks_between_triggers, days_of_week=days_of_week, )