Scheduled task created. TaskName, TaskContent (XML with action/triggers/principals), SubjectUserName are key. XML content reveals exactly what the task does.
Primary persistence mechanism (T1053.005). Tasks executing from temp/user paths, encoded PowerShell in actions, run-at-startup or logon triggers. Tools: schtasks.exe, Register-ScheduledTask. Common ransomware pre-deployment step.
Alert: TaskContent contains PowerShell -enc or wscript. Alert: task action in %TEMP% or %APPDATA%. Alert: created by non-SYSTEM outside business hours. Alert: RunAs SYSTEM created by non-admin. Parse TaskContent XML for suspicious CommandLine.
TaskNameSubjectUserNameClientProcessId | Tactic | Technique |
|---|---|
| Persistence | Scheduled Task (T1053.005) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
title: Suspicious Scheduled Task Created
status: stable
description: Scheduled task with suspicious content created
author: theadminstack.com
date: 2026/05/16
logsource:
product: windows
service: security
detection:
selection:
EventID: 4698
TaskContent|contains:
- 'powershell'
- 'cmd.exe'
- 'wscript'
- 'AppData'
- 'Temp'
condition: selection
falsepositives:
- Legitimate software installers
- Admin automation
level: high
tags:
- attack.persistence
- attack.t1053.005SecurityEvent
| where EventID == 4698 // A scheduled task was created
| project TimeGenerated, Computer, TaskName, SubjectUserName, ClientProcessId
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4698
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A scheduled task was created — add EventData fields: TaskName, SubjectUserName, ClientProcessId`A scheduled task was created. Scheduled task created. TaskName, TaskContent (XML with action/triggers/principals), SubjectUserName are key. XML content reveals exactly what the task does.
Event 4698 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Policy Change' subcategory (Success and/or Failure).
Event 4698 is associated with: Scheduled Task (T1053.005).
Alert: TaskContent contains PowerShell -enc or wscript. Alert: task action in %TEMP% or %APPDATA%. Alert: created by non-SYSTEM outside business hours. Alert: RunAs SYSTEM created by non-admin. Parse TaskContent XML for suspicious CommandLine.