hunting-for-suspicious-scheduled-tasks

name	hunting-for-suspicious-scheduled-tasks
description	Hunt for adversary persistence and execution via Windows scheduled tasks by analyzing task creation events, suspicious task properties, and unusual execution patterns that indicate T1053.005 abuse.
domain	cybersecurity
subdomain	threat-hunting
tags	["threat-hunting","scheduled-tasks","persistence","mitre-t1053-005","windows","endpoint-detection"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"]

Hunting for Suspicious Scheduled Tasks

When to Use

• When proactively hunting for persistence mechanisms in Windows environments
• After detecting schtasks.exe or at.exe usage in process creation logs
• When investigating malware that survives reboots and user logoffs
• During incident response to enumerate all persistence on compromised systems
• When Windows Security Event ID 4698 (Scheduled Task Created) fires for unusual tasks

Detection Gaps & Validation

• Audit gap, not "no activity": Security EID 4698/4702 only log when "Object Access > Other Object Access Events" auditing is enabled (default OFF) — absence of 4698 does NOT mean no tasks. Corroborate with Microsoft-Windows-TaskScheduler/Operational (EID 106/140/200) and the registry HKLM\...\Schedule\TaskCache\Tree.
• Action-type evasion: tasks whose action is a ComHandler CLSID, and tasks created by writing directly to TaskCache, bypass schtasks.exe EID 1 command-line hunting.
• SD-deletion hiding: removing the task's SD makes it vanish from schtasks /query and the GUI while it still executes — diff TaskCache\Tree GUIDs against \Tasks to surface orphans.
• Renamed binary: match EID 1 OriginalFileName + CommandLine, since a renamed schtasks.exe defeats Image-name rules.
• Validate: run Atomic T1053.005 schtasks and Register-ScheduledTask; confirm 4698 + a new TaskCache registry entry both appear.
• FP tuning: baseline \Microsoft\Windows\ built-ins and vendor updater tasks by author/signer.

Prerequisites

• Windows Security Event ID 4698/4699/4702 (Task Created/Deleted/Updated)
• Sysmon Event ID 1 for schtasks.exe process creation with command lines
• Windows Task Scheduler operational log (Microsoft-Windows-TaskScheduler/Operational)
• PowerShell logging for Register-ScheduledTask cmdlet usage
• Access to Task Scheduler XML definitions on endpoints

Workflow

1. Enumerate All Scheduled Tasks: Collect complete task inventory from target systems using schtasks /query /fo CSV /v or Get-ScheduledTask PowerShell cmdlet.
2. Monitor Task Creation Events: Track Event ID 4698 for new task creation, correlating with the creating process and user account context.