Task Scheduler Event ID 200: Action started
Written when a scheduled task runs its action, with the program it launched.
- Log
- Microsoft-Windows-TaskScheduler/Operational
- Category
- Execution
Why it matters
- Shows when a persistence task actually fired, and what it ran.
What to check
Check Task Name and Action Name (the program path).
How to turn it on
Turn on the Microsoft-Windows-TaskScheduler/Operational log.
MITRE ATT&CK
- T1053.005 Scheduled Task