skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunting-for-scheduled-task-persistence

Detect adversary persistence via Windows Scheduled Tasks using SIEM and EDR telemetry.

954|172|Updated Mar 13, 2026
Search Tags:#persistence#threat hunting#scheduled tasks#siem#mitre attack#Windows security#t1053
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-scheduled-task-persistence
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunting-for-scheduled-task-persistence
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/hunting-for-scheduled-task-persistence
Command: npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-scheduled-task-persistence

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Attackers commonly establish persistence on Windows systems by creating scheduled tasks (MITRE ATT&CK T1053.005), and these tasks often evade default logging configurations. This Skill guides analysts through a structured threat hunt to surface malicious scheduled tasks that standard alerting misses.

Core Features & Use Cases

  • Hypothesis-Driven Hunting Workflow: A seven-step process from hypothesis formulation through query execution, validation, and reporting.
  • Detection Gap Coverage: Documents blind spots such as disabled EID 4698 auditing, ComHandler action evasion, hidden tasks via SDDL deletion, and Linux cron/at equivalents.
  • Multi-Platform Query Support: Covers CrowdStrike, Microsoft Defender for Endpoint (KQL), Splunk (SPL), Elastic, Sysmon, and Velociraptor.
  • Use Case: After threat intelligence reports a campaign using scheduled task persistence, an analyst runs the hunt to query task creation events, baseline legitimate updater tasks, and validate findings with Atomic Red Team T1053.005 tests.

Quick Start

Hunt for suspicious scheduled task persistence on Windows endpoints by analyzing task creation events and unusual scheduling patterns across my SIEM and EDR data.

Frequently Asked Questions about hunting-for-scheduled-task-persistence

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I hunt for scheduled task persistence on Windows?▼

Query Security Event ID 4698 (task created) and 4702 (task updated), plus Microsoft-Windows-TaskScheduler/Operational events 106, 140, and 200. Correlate task actions with suspicious executables, encoded PowerShell, and unusual scheduling intervals, then baseline known-good tasks like GoogleUpdate and SCCM.

What tools detect malicious scheduled tasks?▼

Microsoft Defender for Endpoint supports KQL advanced hunting, CrowdStrike provides EDR telemetry, and Splunk or Elastic analyze forwarded logs. Sysmon adds detailed process monitoring, while Velociraptor collects endpoint artifacts and Sigma rules provide cross-platform detection logic.

Why is Event ID 4698 missing from my Windows logs?▼

EID 4698 only logs when the 'Object Access > Other Object Access Events' audit subcategory is enabled, which is off by default. Corroborate with TaskScheduler/Operational logs and validate coverage by running Atomic Red Team T1053.005 tests with schtasks /create.

Can attackers hide scheduled tasks from schtasks queries?▼

Yes. Deleting the SD (SDDL) value removes a task from schtasks /query and the GUI while it still executes. Detect hidden tasks by diffing TaskCache GUIDs in the registry under Schedule\TaskCache\Tree against visible task listings.

Does this hunting approach work for Linux persistence?▼

Windows event queries do not cover Linux cron (T1053.003) or at jobs (T1053.002). Linux hunting requires auditd watches on /etc/cron* directories and crontab files rather than Windows Security or TaskScheduler logs.

Related Skills

Explore More Software Engineering Skills→
OpenTideHQOpenTideHQ
4

windows-event-logs

Document Windows-native telemetry sources and audit policy prerequisites for detection engineering.

Official
Advanced
Happy-Technologies-LLCHappy-Technologies-LLC
34

security-recommended-actions

Generate phased security incident response actions with MITRE mappings.

Official
Advanced
dapperdiversdapperdivers
1

threat-intel-aggregator

Aggregate threat intelligence feeds and vulnerability data into daily security briefings.

Community
Advanced
riparinoriparino
1

defensive-detection-engineering

Automates Sigma rule development, validation, and deployment with MITRE Navigator mapping and FP tuning for SIEM pipelines.

Community
Advanced