Windows Event ID 4702 — A scheduled task was updated

Existing scheduled task was modified. New TaskContent replaces old content.

Why event 4702 matters

Stealthy persistence by modifying existing legitimate tasks rather than creating new ones — task retains its original name but executes attacker payload.

How to detect it

Alert: TaskContent changes adding PowerShell, cmd, or paths in temp/user directories. Compare new vs. old task content if available.

MITRE ATT&CK mapping

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

SecurityEvent
| where EventID == 4702   // A scheduled task was updated
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc

index=* sourcetype="WinEventLog:Security" EventCode=4702
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# A scheduled task was updated — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`

Related Policy Change events