Windows Security Event 4698 Scheduled Task Creation for TeamCity UI
Flags Windows scheduled task creation events where the task name is TeamCity Settings UI and content contains a specific marker.
- Product
- windows
- Service
- security
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-10-24
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches Windows Security auditing events (EventID 4698) indicating a scheduled task was created with TaskName set to "\Windows TeamCity Settings User Interface" and specific task content containing the marker string "uTYNkfKxHiZrx3KJ". Attackers may create scheduled tasks to establish persistence or run exploitation-related actions under a controlled trigger. It relies on Security log telemetry that records scheduled task creation details, including TaskName and TaskContent.
Reporting behind it
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Diamond-Sleet/win_security_apt_diamond_sleet_scheduled_task.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Security Event 4698 Scheduled Task Creation for TeamCity UI
id: 3d029d54-4a55-416d-9382-d501b188714a
status: test
description: This rule matches Windows Security auditing events (EventID 4698) indicating a scheduled task was created with TaskName set to "\Windows TeamCity Settings User Interface" and specific task content containing the marker string "uTYNkfKxHiZrx3KJ". Attackers may create scheduled tasks to establish persistence or run exploitation-related actions under a controlled trigger. It relies on Security log telemetry that records scheduled task creation details, including TaskName and TaskContent.
references:
- https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Diamond-Sleet/win_security_apt_diamond_sleet_scheduled_task.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-24
tags:
- attack.execution
- attack.privilege-escalation
- attack.persistence
- attack.t1053.005
- detection.emerging-threats
logsource:
product: windows
service: security
definition: The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data.
detection:
selection:
EventID: 4698
TaskName: \Windows TeamCity Settings User Interface
TaskContent|contains: uTYNkfKxHiZrx3KJ
condition: selection
falsepositives:
- Unknown
level: critical
license: DRL-1.1
related:
- id: 3b8e5084-4de9-449a-a40d-0e11014f2e2d
type: derived