Windows Scheduled Task Creation Using SVR-Specific Task Names
Alerts on Windows scheduled task events with SVR-associated task names indicative of persistence.
FreeReviewedSigma · High · v5
- Product
- windows
- Service
- security
- Author
- CISA (SigmaHQ), DRL 1.1
- Published
- 2023-12-18
- Updated
- 2026-07-31
What it detects
This rule flags Windows security events where scheduled task operations (creation, update, or assignment) reference a set of SVR-specific task names. Attackers may use scheduled tasks to persist or periodically execute malicious components, making these task name patterns useful for early compromise hunting. It relies on Windows Security audit events 4698, 4699, and 4702 with the corresponding TaskName field matching the listed values.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-scheduled-task-creation-using-svr-specific-task-names-8fa65166
title: Windows Scheduled Task Creation Using SVR-Specific Task Names
id: a9342a9e-548e-47aa-a09c-a25c630607d6
related:
- id: 2bfc1373-0220-4fbd-8b10-33ddafd2a142
type: similar
- id: 8fa65166-f463-4fd2-ad4f-1436133c52e1
type: derived
status: test
description: This rule flags Windows security events where scheduled task operations (creation, update, or assignment) reference a set of SVR-specific task names. Attackers may use scheduled tasks to persist or periodically execute malicious components, making these task name patterns useful for early compromise hunting. It relies on Windows Security audit events 4698, 4699, and 4702 with the corresponding TaskName field matching the listed values.
author: CISA, Huntrule Team
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Cozy-Bear/win_security_apt_cozy_bear_scheduled_tasks_name.yml
date: 2023-12-18
tags:
- attack.persistence
- detection.emerging-threats
logsource:
service: security
product: windows
detection:
selection:
EventID:
- 4698
- 4699
- 4702
TaskName:
- \defender
- \Microsoft\DefenderService
- \Microsoft\Windows\Application Experience\StartupAppTaskCheck
- \Microsoft\Windows\Application Experience\StartupAppTaskCkeck
- \Microsoft\Windows\ATPUpd
- \Microsoft\Windows\Data Integrity Scan\Data Integrity Update
- \Microsoft\Windows\DefenderUPDService
- \Microsoft\Windows\IISUpdateService
- \Microsoft\Windows\Speech\SpeechModelInstallTask
- \Microsoft\Windows\WiMSDFS
- \Microsoft\Windows\Windows Defender\Defender Update Service
- \Microsoft\Windows\Windows Defender\Service Update
- \Microsoft\Windows\Windows Error Reporting\CheckReporting
- \Microsoft\Windows\Windows Error Reporting\SubmitReporting
- \Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStart
- \Microsoft\Windows\WindowsDefenderService
- \Microsoft\Windows\WindowsDefenderService2
- \Microsoft\Windows\WindowsUpdate\Scheduled AutoCheck
- \Microsoft\Windows\WindowsUpdate\Scheduled Check
- \WindowUpdate
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1