drop scheduled task xml export · detect non-standard trigger encodings · runs locally
base64 triggers · hidden logon types · non-printable trigger payloads
heuristic screener · parses exports locally · not definitive proof