skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-malicious-scheduled-tasks-with-sysmon

Detect malicious scheduled task creation using Sysmon and Windows Security event correlation.

954|172|Updated Mar 13, 2026
Search Tags:#persistence#detection#threat hunting#scheduled tasks#sysmon#Windows security#t1053
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-malicious-scheduled-tasks-with-sysmon
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-malicious-scheduled-tasks-with-sysmon
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/detecting-malicious-scheduled-tasks-with-sysmon
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-malicious-scheduled-tasks-with-sysmon

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Adversaries abuse Windows Task Scheduler for persistence and lateral movement (MITRE T1053.005), and single-source detection rules miss tasks created via COM APIs, PowerShell, or direct XML drops. This Skill provides a structured methodology to correlate Sysmon and Windows Security events so analysts catch malicious scheduled tasks regardless of how they were created.

Core Features & Use Cases

  • Multi-Source Event Correlation: Combines Sysmon Event IDs 1, 11, 12, 13 with Windows Security Events 4698/4702 to cover schtasks.exe, COM-based, and file-drop task creation paths.
  • Detection Gap Guidance: Documents blind spots such as Tarrask hidden tasks, disabled 4698 auditing, and LOLBin variants like at.exe, with validation steps to confirm rules fire.
  • Use Case: A SOC analyst hunting for persistence builds a rule alerting on tasks executing from C:\Users\Public with encoded PowerShell payloads, then validates coverage by creating test tasks via both schtasks and Register-ScheduledTask.

Quick Start

Ask the AI to build a detection rule that correlates Sysmon Event ID 1 and Security Event 4698 to flag suspicious scheduled task creation on Windows endpoints.

Frequently Asked Questions about detecting-malicious-scheduled-tasks-with-sysmon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect malicious scheduled tasks with Sysmon?▼

Monitor Sysmon Event ID 1 for schtasks.exe process creation with suspicious command lines, Event ID 11 for XML files written to C:\Windows\System32\Tasks\, and correlate with Security Event 4698. Alert on encoded commands, public directory paths, and remote creation via schtasks /s.

Which Windows event IDs detect scheduled task persistence?▼

The key events are Sysmon Event ID 1 (process creation), Event ID 11 (task file creation), Event IDs 12/13 (registry changes), and Windows Security Events 4698 (task registered) and 4702 (task updated). Together they cover MITRE T1053.005 activity.

Why does my schtasks detection rule miss some scheduled tasks?▼

Tasks created via the Schedule COM API, PowerShell Register-ScheduledTask, or direct XML drops never spawn schtasks.exe, so Sysmon Event ID 1 misses them. Cover Security Event 4698 and Sysmon Event ID 11, and verify 4698 auditing is enabled with auditpol.

How do attackers hide scheduled tasks from detection?▼

The Tarrask technique deletes a task's SD registry value under HKLM\...\Schedule\TaskCache\Tree\, hiding it from schtasks and the Task Scheduler UI. Hunt Sysmon registry events for a Tree key created without a corresponding SD value.

How do I reduce false positives in scheduled task detection?▼

Baseline known-good task creators such as Google, Edge, and Adobe updaters by task path and signed binary. Alert only on new or unsigned task authors, encoded payloads, or execution from user-writable directories like %APPDATA% and %TEMP%.

Related Skills

Explore More Software Engineering Skills→
GhostPWNGhostPWN
4

Log Analysis & SIEM Integration

Parse security logs and generate SIEM detection queries for Splunk, Elastic, QRadar, Sentinel, and Sigma.

Official
Advanced
vigoliumvigolium
1.1k

sqli-to-data-exfil

Escalates suspected SQL injection into verified data exfiltration with persisted findings.

Official
Advanced
cosmixcosmix
53

logging-observability

Implement structured JSON logging and distributed tracing with OpenTelemetry.

Community
Advanced
balsm-healthbalsm-health
2

hunting-for-persistence-mechanisms-in-windows

Identify adversary persistence mechanisms in Windows endpoints via registry keys, services, scheduled tasks, and WMI subscriptions.

Official
Advanced