domains / families / security / hunting-for-suspicious-scheduled-tasks

hunting-for-suspicious-scheduled-tasks

separate

Hunts for adversary persistence and execution via Windows scheduled tasks (T1053.005) by analyzing Security Event ID 4698 task-creation events, suspicious task properties, and unusual execution patterns from schtasks.exe/at.exe. Use after detecting schtasks or at.exe in process creation logs, during incident response to enumerate persistence on compromised hosts, or when Event ID 4698 fires for an unusual task.

When to use

• When proactively hunting for persistence mechanisms in Windows environments
• After detecting schtasks.exe or at.exe usage in process creation logs
• When investigating malware that survives reboots and user logoffs
• During incident response to enumerate all persistence on compromised systems
• When Windows Security Event ID 4698 (Scheduled Task Created) fires for unusual tasks

Skill page

Source