Hunting Scheduled Task Abuse

When to Use

• You have task-registration events (4698) and/or schtasks.exe/at.exe process telemetry and want to detect persistence via malicious scheduled tasks.
• You are investigating tasks that run scripts, encoded commands, or binaries from suspicious paths.

Do not use this to alert on all task creation — administration creates tasks routinely. Hunt on the action (script hosts, encoded commands, temp paths) and trigger context.

Prerequisites

• Event ID 4698 (task registered) and/or process-creation telemetry for schtasks/at.

Workflow

Step 1: Hunt suspicious task actions

python scripts/analyst.py hunt events.csv

Flags tasks whose action runs powershell -enc, mshta, wscript/cscript, cmd /c, or binaries from %TEMP%/%APPDATA%/Public, and schtasks /create command lines with the same.

Step 2: Assess triggers and hiding

Note logon/onstart triggers, very frequent intervals, and tasks hidden via Hidden flag or SD manipulation.

Step 3: Confirm

Distinguish legitimate software tasks from intrusion by author, path, and action content.

Step 4: Operationalize

Write a Sigma rule for task actions invoking script hosts or encoded commands.

Validation

• Flags require a suspicious action/path, not task creation alone.
• schtasks /create and 4698 registrations are both covered.
• Findings map to ATT&CK T1053.005.

Pitfalls

• Legitimate updater tasks (browsers, vendors) creating many tasks.
• Tasks created via direct XML drop bypassing schtasks.exe telemetry.
• Encoded commands hiding the true action.

References

• See references/api-reference.md for the hunter.
• ATT&CK T1053.005 and Event 4698 docs (linked in frontmatter).