Event ID 4699: A scheduled task was deleted
Written when a scheduled task is deleted.
- Log
- Security
- Category
- Persistence
Why it matters
- A task created and deleted within minutes is a common way to run something once on a remote machine and tidy up.
What to check
Look for the matching 4698 to see what the task did.
How to turn it on
Advanced Audit Policy: Object Access > Audit Other Object Access Events.
MITRE ATT&CK
- T1053.005 Scheduled Task