Task Scheduler Event ID 106: Task registered
Written when a scheduled task is registered, with the task name and the user who registered it.
- Log
- Microsoft-Windows-TaskScheduler/Operational
- Category
- Persistence
Why it matters
- Useful where Security auditing of tasks (4698) is not turned on. Does not include the command; check the task itself.
What to check
Check Task Name and User, then the task's action in Task Scheduler or C:\Windows\System32\Tasks.
How to turn it on
Turn on the Microsoft-Windows-TaskScheduler/Operational log (off by default on some versions).
MITRE ATT&CK
- T1053.005 Scheduled Task