Detecting Scheduled Task Persistence: Analyzing Schtasks and Security Event 4698

The Windows Task Scheduler manages automated background tasks across the operating system. Because it supports execution under elevated privileges (including SYSTEM) and configurable triggers such as system startup or user logon, adversaries frequently abuse it to establish persistence or facilitate lateral movement.

Adversaries use both the command-line utility schtasks.exe and remote RPC interfaces to create tasks that survivie reboots. Detecting this activity requires correlating process command lines with Windows Security Event Log records that parse the underlying task XML definitions.

Attacker command-line switches with schtasks.exe

Attackers create tasks using the `/create` parameter. A representative persistence command looks like:

schtasks.exe /create /tn "GoogleUpdateTask" /tr "C:\Users\Public\update.exe" /sc ONLOGON /ru "SYSTEM" /f

The parameters dictate how and when the payload executes:

• /tn: Task Name; attackers often masquerade under names mimicking legitimate vendors like Google, Adobe, or Microsoft.
• /tr: Task Run; path to the binary or script executed by the scheduler.
• /sc: Schedule frequency; triggers include ONLOGON, ONSTART, or MINUTE intervals.
• /ru: Run User; specifying "SYSTEM" elevates standard user context to NT AUTHORITY\SYSTEM.
• /f: Force; suppresses warning prompts if a task with the same name already exists.

Adversaries also invoke LOLBins directly inside the `/tr` parameter, such as `powershell.exe -enc ...` or `mshta.exe http://...`, avoiding custom binaries on disk.

Parsing Windows Security Event ID 4698

While attackers can rename schtasks.exe or create tasks via PowerShell or native COM objects, the Windows Task Scheduler service generates specific Security Event Log entries when audit policies are enabled:

• Event ID 4698: A scheduled task was created.
• Event ID 4699: A scheduled task was deleted.
• Event ID 4700: A scheduled task was enabled.
• Event ID 4702: A scheduled task was updated.

Event ID 4698 contains an embedded XML payload under `EventData.TaskContent` that documents the full configuration of the new task. Key elements within the XML include:

• <Command>: The executable path specified in the action.
• <Arguments>: Command-line switches passed to the executable.
• <UserId>: The account identity configured to run the task.
• <LogonTrigger> or <BootTrigger>: The event condition that initiates execution.

Extracting the `<Command>` and `<Arguments>` tags allows SIEM rules to detect malicious scripts even when the task was created programmatically over remote RPC without spawning schtasks.exe.

KQL query to detect anomalous scheduled tasks

This query inspects Event ID 4698 in Microsoft Sentinel and extracts the target executable path and arguments from the embedded XML definition:

SecurityEvent
| where EventID == 4698
| parse EventData with * '<TaskContent>' TaskContent '</TaskContent>' *
| parse TaskContent with * '<Command>' TaskCommand '</Command>' *
| parse TaskContent with * '<Arguments>' TaskArguments '</Arguments>' *
| where TaskCommand has_any ("powershell.exe", "cmd.exe", "mshta.exe", "wscript.exe", "cscript.exe")
or TaskArguments has_any ("http://", "https://", "-enc", "bypass")
or TaskCommand has_any ("\Users\", "\AppData\", "\Temp\")
| project TimeGenerated, Computer, Account, TaskName = extract("<TaskName>([^<]+)</TaskName>", 1, EventData), TaskCommand, TaskArguments

Hunting and auditing recommendations

Regularly baseline scheduled tasks across your fleet. Export and review tasks configured in `C:\Windows\System32\Tasks`. Look for tasks executing from user-writable directories or referencing binaries that do not have valid digital signatures. Ensure Windows "Audit Other Object Access Events" is enabled to capture Event ID 4698 across domain controllers and member servers.

Check our detailed schtasks LOLBin profile, inspect other tools in the Persistence category, and review MITRE ATT&CK T1053 Scheduled Task/Job. You can also deploy production-ready queries from our KQL catalog.

Authoritative documentation is available on Microsoft Learn Windows Security Event 4698 and MITRE ATT&CK Technique T1053.005.