Windows Security: Suspicious Scheduled Task Creation via Event 4698 and TaskContent indicators

title: "Windows Security: Suspicious Scheduled Task Creation via Event 4698 and TaskContent indicators"
id: bea82689-edaf-49c2-bf27-1d2fb41a23ee
status: test
description: This rule flags Windows scheduled task creation events (EventID 4698) when the embedded TaskContent matches suspicious paths and/or command-line style indicators. Attackers may use scheduled tasks for persistence or privilege-related execution, so watching for task content that references common staging locations and living-off-the-land command patterns is valuable. The detection relies on Windows Security audit telemetry that includes TaskContent for the created task, matching it against specific path and command substrings.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_scheduled_task_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-05
modified: 2022-12-07
tags:
  - attack.execution
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1053.005
logsource:
  product: windows
  service: security
  definition: The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data.
detection:
  selection_eid:
    EventID: 4698
  selection_paths:
    TaskContent|contains:
      - \AppData\Local\Temp\
      - \AppData\Roaming\
      - \Users\Public\
      - \WINDOWS\Temp\
      - C:\Temp\
      - \Desktop\
      - \Downloads\
      - \Temporary Internet
      - C:\ProgramData\
      - C:\Perflogs\
  selection_commands:
    TaskContent|contains:
      - regsvr32
      - rundll32
      - cmd.exe</Command>
      - cmd</Command>
      - "<Arguments>/c "
      - "<Arguments>/k "
      - "<Arguments>/r "
      - powershell
      - pwsh
      - mshta
      - wscript
      - cscript
      - certutil
      - bitsadmin
      - bash.exe
      - "bash "
      - scrcons
      - "wmic "
      - wmic.exe
      - forfiles
      - scriptrunner
      - hh.exe
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 3a734d25-df5c-4b99-8034-af1ddb5883a4
    type: derived