Event ID 4698: A scheduled task was created
Written when a scheduled task is created. The event includes the task's full XML definition, with its trigger and command.
- Log
- Security
- Category
- Persistence
Why it matters
- One of the most common persistence methods. Tasks that run scripts, encoded commands or files from user folders deserve a look.
- Tasks can also be used to run code on a remote machine.
What to check
Read the Task Content XML: check the Command, Arguments, trigger, and the account it runs as.
How to turn it on
Advanced Audit Policy: Object Access > Audit Other Object Access Events.
MITRE ATT&CK
- T1053.005 Scheduled Task