Scheduled task created
mediumWindowsSingle eventstablewindows.persistence.scheduled_task_created · v1.0.0
Detects creation of a scheduled task (Security 4698).
What it detects
Detects creation of a scheduled task (Security 4698). Scheduled tasks are one of the most common Windows persistence and lateral-movement mechanisms.
MITRE ATT&CK mapping
- T1053.005Scheduled Task/Job: Scheduled Task· Execution
False positives and triage
Software installers and updaters create tasks routinely. Review the task name, the action it runs, and the creating account.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/windows/scheduled_task_created.yaml, licensed under the Apache License 2.0.
id: windows.persistence.scheduled_task_created
version: 1.0.0
status: stable
severity: medium
confidence: 0.6
platforms: [windows]
mitre_techniques: [T1053.005]
description: |
Detects creation of a scheduled task (Security 4698). Scheduled tasks are one of the most
common Windows persistence and lateral-movement mechanisms.
match:
event_category: scheduled_task
event_action: task_created
false_positive_guidance: |
Software installers and updaters create tasks routinely. Review the task name, the action
it runs, and the creating account.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.