skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunting-for-suspicious-scheduled-tasks

Detect adversary persistence via Windows scheduled tasks using event logs and SIEM queries.

954|172|Updated Mar 13, 2026
Search Tags:#persistence#threat hunting#windows#scheduled tasks#splunk#KQL#t1053
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-suspicious-scheduled-tasks
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunting-for-suspicious-scheduled-tasks
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/hunting-for-suspicious-scheduled-tasks
Command: npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-suspicious-scheduled-tasks

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Attackers abuse Windows scheduled tasks (MITRE ATT&CK T1053.005) to establish persistence, execute payloads, and move laterally, and default auditing often misses this activity. This Skill gives threat hunters a structured methodology, detection queries, and validation steps to surface malicious scheduled tasks before they are used against the environment.

Core Features & Use Cases

  • Detection Queries: Ready-to-use Splunk SPL and KQL (Microsoft Sentinel) queries for Event ID 4698 task creation and suspicious schtasks.exe command lines.
  • Evasion-Aware Hunting: Covers audit gaps, ComHandler action evasion, Security Descriptor deletion hiding, renamed binaries, and TaskCache registry orphan detection.
  • Structured Workflow: Seven-step hunt process from task enumeration through baseline diffing, with a standardized output format for reporting findings.
  • Use Case: During incident response on a compromised Windows host, run the provided KQL query in Sentinel to find tasks executing PowerShell from AppData, then diff TaskCache registry GUIDs against the Tasks folder to reveal hidden persistence.

Quick Start

Hunt for suspicious scheduled tasks on my Windows endpoints using the provided Splunk and KQL detection queries.

Frequently Asked Questions about hunting-for-suspicious-scheduled-tasks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect malicious scheduled tasks in Windows?▼

Monitor Security Event ID 4698 for task creation and Sysmon Event ID 1 for schtasks.exe with /create arguments. Flag tasks running scripts, binaries from user-writable paths like Temp or AppData, or encoded commands, then correlate with Task Scheduler operational logs.

What SIEM queries detect scheduled task persistence?▼

Use Splunk queries on EventCode 4698 filtering out Microsoft and Windows built-in task paths, or KQL in Microsoft Sentinel matching TaskContent containing powershell, cmd.exe, wscript, or suspicious paths. Both approaches are provided as ready-to-run queries.

Why does Event ID 4698 not appear in my Windows logs?▼

Event ID 4698 requires the Object Access > Other Object Access Events audit policy, which is disabled by default. Corroborate with Microsoft-Windows-TaskScheduler/Operational events 106, 140, and 200, plus the TaskCache registry tree, since absence of 4698 does not mean no tasks exist.

Can attackers hide scheduled tasks from schtasks query?▼

Yes, attackers can delete a task's Security Descriptor so it vanishes from schtasks /query and the GUI while still executing. Detect this by diffing TaskCache\Tree registry GUIDs against the \Tasks filesystem folder to surface orphaned entries.

What are the limitations of scheduled task hunting?▼

Tasks using ComHandler CLSID actions or written directly to TaskCache bypass schtasks.exe command-line detection, and renamed schtasks binaries defeat Image-name rules. Match on OriginalFileName plus CommandLine and baseline legitimate vendor updater tasks to reduce false positives.

Related Skills

Explore More Software Engineering Skills→
GhostPWNGhostPWN
4

Log Analysis & SIEM Integration

Parse security logs and generate SIEM detection queries for Splunk, Elastic, QRadar, Sentinel, and Sigma.

Official
Advanced
wgpsecwgpsec
1.7k

emergency-response

Investigate compromised Linux and Windows hosts through account, process, persistence, and log analysis.

Official
Advanced
balsm-healthbalsm-health
2

hunting-for-persistence-mechanisms-in-windows

Identify adversary persistence mechanisms in Windows endpoints via registry keys, services, scheduled tasks, and WMI subscriptions.

Official
Advanced
balsm-healthbalsm-health
2

hunting-for-unusual-network-connections

Analyze EDR, SIEM, and Sysmon logs for unusual network connections.

Official
Advanced