Windows Security: Suspicious Scheduled Task Creation via Event 4698

Alerts on Windows scheduled task creation (EventID 4698) when TaskContent contains suspicious directories or command patterns.

FreeReviewedSigma · High · v2

Product: windows
Service: security
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-12-05
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → Priv Esc

Recon
Resource Dev
Initial Access
Execution
- T1053.005Scheduled Task
Persistence
- T1053.005Scheduled Task
Priv Esc
- T1053.005Scheduled Task
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows Security events (EventID 4698) where scheduled task content includes paths commonly used for staging or user-writable locations and command/script interpreter indicators. Attackers frequently use scheduled tasks for persistence and execution by embedding commands such as PowerShell, mshta, wscript/cscript, certutil, bitsadmin, wmic, or batch-like /c-/k arguments into the task payload. The detection relies on Security auditing data containing TaskContent fields with both path and command substrings.

Reporting behind it

Related detections9 linkedT1053.005 — drag to rearrange

Malicious CloudZ RAT Persistence via schtasks Running regasm.exe

Suspicious Scheduled Task Creation for WSPrint Persistence by UAT-9244

Malicious Scheduled Task Masquerading as GoogleUpdate Launching SSH Reverse Shell

Malicious Scheduled Task Creation TaskSystem via Interlock Ransomware

Malicious Scheduled Task Masquerading as Edge Update Running From Temp (via process_creation)

Suspicious Scheduled Task Created From XML Definition (via process_creation)

Malicious Scheduled Task Masquerade for Zardoor Persistence (via process_creation)

Malicious BugSleep Scheduled Task Persistence with Sample Comment

Suspicious Scheduled Task Masquerading As OneDrive (via process_creation)

Windows Security: Suspicious Scheduled Task Creation via Event 4698

Pivot detection · T1053.005 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-suspicious-scheduled-task-creation-via-event-4698-and-taskconte-3a734d25

title: "Windows Security: Suspicious Scheduled Task Creation via Event 4698"
id: bea82689-edaf-49c2-bf27-1d2fb41a23ee
status: test
description: This rule flags Windows Security events (EventID 4698) where scheduled task content includes paths commonly used for staging or user-writable locations and command/script interpreter indicators. Attackers frequently use scheduled tasks for persistence and execution by embedding commands such as PowerShell, mshta, wscript/cscript, certutil, bitsadmin, wmic, or batch-like /c-/k arguments into the task payload. The detection relies on Security auditing data containing TaskContent fields with both path and command substrings.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_scheduled_task_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-05
modified: 2022-12-07
tags:
  - attack.execution
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1053.005
logsource:
  product: windows
  service: security
  definition: The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data.
detection:
  selection_eid:
    EventID: 4698
  selection_paths:
    TaskContent|contains:
      - \AppData\Local\Temp\
      - \AppData\Roaming\
      - \Users\Public\
      - \WINDOWS\Temp\
      - C:\Temp\
      - \Desktop\
      - \Downloads\
      - \Temporary Internet
      - C:\ProgramData\
      - C:\Perflogs\
  selection_commands:
    TaskContent|contains:
      - regsvr32
      - rundll32
      - cmd.exe</Command>
      - cmd</Command>
      - "<Arguments>/c "
      - "<Arguments>/k "
      - "<Arguments>/r "
      - powershell
      - pwsh
      - mshta
      - wscript
      - cscript
      - certutil
      - bitsadmin
      - bash.exe
      - "bash "
      - scrcons
      - "wmic "
      - wmic.exe
      - forfiles
      - scriptrunner
      - hh.exe
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 3a734d25-df5c-4b99-8034-af1ddb5883a4
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL