Windows Event ID 4698 — Scheduled Task Created

MITRE ATT&CK

Why It Matters

Scheduled tasks are the most common persistence mechanism in Windows-targeted attacks — they survive reboots, run under SYSTEM or high-privilege accounts, and blend into the hundreds of legitimate tasks already present. Ransomware, APTs, and commodity malware all use them. Attackers name tasks to mimic legitimate Windows components (MicrosoftEdgeUpdateTaskMachine, WindowsDefenderScheduledScan, GoogleUpdateTask) to avoid scrutiny. Remote task creation — where a task is registered on a target host from an attacker-controlled system — requires valid admin credentials and generates 4698 on the target, making it a strong lateral movement indicator alongside 4624 Type 3.

Key Fields

Investigation Tips

1. 1.Task XML is the investigation core: parse the <Actions><Exec> block. Red flags in <Command>: powershell.exe, cmd.exe, wscript.exe, mshta.exe, certutil.exe. Red flags in <Arguments>: -EncodedCommand / -enc (encoded payload), -WindowStyle Hidden (execution without UI), http:// / https:// (download and execute). Any of these from a non-deployment account = malicious.
2. 2.Run-as account matters: check <Principal> for the execution context. <RunLevel>HighestAvailable</RunLevel> or <UserId>S-1-5-18</UserId> (SYSTEM) means the payload runs with maximum privilege. A task that runs as SYSTEM with a command pointing to AppData, Temp, or a UNC path = critical.
3. 3.Camouflage detection: compare the Task Name against Windows built-in task paths. Legitimate Windows tasks are under \Microsoft\Windows\, \Microsoft\Office\, or vendor-specific paths — all well-documented. An unknown name in those paths, or a name that's one character off from a real task, is a naming spoof. Check the creation timestamp: built-in tasks are created at OS install or software update, not during business hours from a user session.
4. 4.Remote task creation = lateral movement: if Subject Logon ID maps to a 4624 Type 3 (network) logon on this host, the task was registered remotely. Identify the source IP — this is the host the attacker is pivoting from. Remote task registration is a core technique in Impacket's atexec.py.
5. 5.Correlate with 4688: schtasks.exe with /create in its command line, or PowerShell invoking Register-ScheduledTask or New-ScheduledTaskAction, should appear in process creation events just before 4698. If no corresponding 4688 exists, the task was created via the COM API directly — a less common but stealthier path used by advanced malware.
6. 6.Audit policy: 4698 requires 'Audit Other Object Access Events' under Advanced Audit Policy → Object Access. Without this, all scheduled task creation is invisible. Verify via GPO — many environments have this disabled by default.

Related Event IDs