Event ID 4702: A scheduled task was updated
Written when an existing scheduled task is changed.
- Log
- Security
- Category
- Persistence
Why it matters
- Changing an existing, trusted-looking task is quieter than creating a new one.
What to check
Compare the new Task Content XML with the previous definition.
How to turn it on
Advanced Audit Policy: Object Access > Audit Other Object Access Events.
MITRE ATT&CK
- T1053.005 Scheduled Task