Data Source: Windows Event Log Security 4698

Created: 2024-05-22

Last Updated: 2026-10-14

ID: 32c06703-02d3-47ec-8856-b0dc3045866c

Author: Patrick Bareiss, Splunk

Description

Logs an event when a new scheduled task is created

Details

Property	Value
Source	`XmlWinEventLog:Security`
Sourcetype	`XmlWinEventLog`
Separator	EventCode

Name ▲▼	Technique ▲▼	Type ▲▼
Windows Scheduled Task with Suspicious Name	Scheduled Task	TTP
Schedule Task with Rundll32 Command Trigger	Scheduled Task/Job	TTP
WinEvent Scheduled Task Created to Spawn Shell	Scheduled Task	TTP
Windows Hidden Schedule Task Settings	Scheduled Task/Job	TTP
Windows Scheduled Tasks for CompMgmtLauncher or Eventvwr	Scheduled Task/Job	TTP
WinEvent Scheduled Task Created Within Public Path	Scheduled Task	TTP
Schedule Task with HTTP Command Arguments	Scheduled Task/Job	TTP
Randomly Generated Scheduled Task Name	Scheduled Task	Hunting
Windows Scheduled Task with Suspicious Command	Scheduled Task	TTP
Short Lived Scheduled Task	Scheduled Task	Anomaly
Windows Level RMM Watchdog Task Created	Scheduled Task/Job, Remote Access Tools	Anomaly

Supported Apps

Splunk Add-on for Microsoft Windows (version 11.0.3)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">action</span>
  
  <span class="pill kill-chain">ActivityID</span>
  
  <span class="pill kill-chain">app</span>
  
  <span class="pill kill-chain">Caller_Domain</span>
  
  <span class="pill kill-chain">Caller_User_Name</span>
  
  <span class="pill kill-chain">change_type</span>
  
  <span class="pill kill-chain">Channel</span>
  
  <span class="pill kill-chain">ClientProcessId</span>
  
  <span class="pill kill-chain">ClientProcessStartKey</span>
  
  <span class="pill kill-chain">Computer</span>
  
  <span class="pill kill-chain">dest</span>
  
  <span class="pill kill-chain">dest_nt_domain</span>
  
  <span class="pill kill-chain">dvc</span>
  
  <span class="pill kill-chain">dvc_nt_host</span>
  
  <span class="pill kill-chain">Error_Code</span>
  
  <span class="pill kill-chain">event_id</span>
  
  <span class="pill kill-chain">event_time</span>
  
  <span class="pill kill-chain">EventCode</span>
  
  <span class="pill kill-chain">EventData_Xml</span>
  
  <span class="pill kill-chain">EventID</span>
  
  <span class="pill kill-chain">EventRecordID</span>
  
  <span class="pill kill-chain">eventtype</span>
  
  <span class="pill kill-chain">FQDN</span>
  
  <span class="pill kill-chain">Guid</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">id</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">Keywords</span>
  
  <span class="pill kill-chain">Level</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">Logon_ID</span>
  
  <span class="pill kill-chain">Name</span>
  
  <span class="pill kill-chain">name</span>
  
  <span class="pill kill-chain">object</span>
  
  <span class="pill kill-chain">object_attrs</span>
  
  <span class="pill kill-chain">object_category</span>
  
  <span class="pill kill-chain">Opcode</span>
  
  <span class="pill kill-chain">ParentProcessId</span>
  
  <span class="pill kill-chain">ProcessID</span>
  
  <span class="pill kill-chain">product</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">RecordNumber</span>
  
  <span class="pill kill-chain">result</span>
  
  <span class="pill kill-chain">RpcCallClientLocality</span>
  
  <span class="pill kill-chain">session_id</span>
  
  <span class="pill kill-chain">severity</span>
  
  <span class="pill kill-chain">severity_id</span>
  
  <span class="pill kill-chain">signature</span>
  
  <span class="pill kill-chain">signature_id</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">src_nt_domain</span>
  
  <span class="pill kill-chain">src_subject_user_id</span>
  
  <span class="pill kill-chain">src_user</span>
  
  <span class="pill kill-chain">status</span>
  
  <span class="pill kill-chain">subject</span>
  
  <span class="pill kill-chain">SubjectDomainName</span>
  
  <span class="pill kill-chain">SubjectLogonId</span>
  
  <span class="pill kill-chain">SubjectUserName</span>
  
  <span class="pill kill-chain">SubjectUserSid</span>
  
  <span class="pill kill-chain">System_Props_Xml</span>
  
  <span class="pill kill-chain">SystemTime</span>
  
  <span class="pill kill-chain">ta_windows_action</span>
  
  <span class="pill kill-chain">tag</span>
  
  <span class="pill kill-chain">tag::eventtype</span>
  
  <span class="pill kill-chain">Task</span>
  
  <span class="pill kill-chain">TaskCategory</span>
  
  <span class="pill kill-chain">TaskContent</span>
  
  <span class="pill kill-chain">TaskName</span>
  
  <span class="pill kill-chain">ThreadID</span>
  
  <span class="pill kill-chain">timestamp</span>
  
  <span class="pill kill-chain">user</span>
  
  <span class="pill kill-chain">user_name</span>
  
  <span class="pill kill-chain">vendor</span>
  
  <span class="pill kill-chain">vendor_product</span>
  
  <span class="pill kill-chain">Version</span>
  
</div>

Example Log

 1<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4698</EventID><Version>1</Version><Level>0</Level><Task>12804</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2024-09-10T10:02:23.845080200Z'/><EventRecordID>341052</EventRecordID><Correlation ActivityID='{54d67b3e-02b6-0003-507b-d654b602db01}'/><Execution ProcessID='612' ThreadID='7324'/><Channel>Security</Channel><Computer>testlab-win-dc.attackrange.local</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>ATTACKRANGE\Administrator</Data><Data Name='SubjectUserName'>administrator</Data><Data Name='SubjectDomainName'>ATTACKRANGE</Data><Data Name='SubjectLogonId'>0x7eb3a</Data><Data Name='TaskName'>\CompMgmtLauncher</Data><Data Name='TaskContent'>&lt;?xml version="1.0" encoding="UTF-16"?&gt;
 2&lt;Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"&gt;
 3  &lt;RegistrationInfo&gt;
 4    &lt;URI&gt;\CompMgmtLauncher&lt;/URI&gt;
 5  &lt;/RegistrationInfo&gt;
 6  &lt;Triggers&gt;
 7    &lt;LogonTrigger&gt;
 8      &lt;Enabled&gt;true&lt;/Enabled&gt;
 9    &lt;/LogonTrigger&gt;
10  &lt;/Triggers&gt;
11  &lt;Principals&gt;
12    &lt;Principal id="Author"&gt;
13      &lt;RunLevel&gt;HighestAvailable&lt;/RunLevel&gt;
14      &lt;UserId&gt;ATTACKRANGE\administrator&lt;/UserId&gt;
15      &lt;LogonType&gt;InteractiveToken&lt;/LogonType&gt;
16    &lt;/Principal&gt;
17  &lt;/Principals&gt;
18  &lt;Settings&gt;
19    &lt;MultipleInstancesPolicy&gt;Parallel&lt;/MultipleInstancesPolicy&gt;
20    &lt;DisallowStartIfOnBatteries&gt;false&lt;/DisallowStartIfOnBatteries&gt;
21    &lt;StopIfGoingOnBatteries&gt;false&lt;/StopIfGoingOnBatteries&gt;
22    &lt;AllowHardTerminate&gt;true&lt;/AllowHardTerminate&gt;
23    &lt;StartWhenAvailable&gt;false&lt;/StartWhenAvailable&gt;
24    &lt;RunOnlyIfNetworkAvailable&gt;false&lt;/RunOnlyIfNetworkAvailable&gt;
25    &lt;IdleSettings&gt;
26      &lt;Duration&gt;PT10M&lt;/Duration&gt;
27      &lt;WaitTimeout&gt;PT1H&lt;/WaitTimeout&gt;
28      &lt;StopOnIdleEnd&gt;true&lt;/StopOnIdleEnd&gt;
29      &lt;RestartOnIdle&gt;false&lt;/RestartOnIdle&gt;
30    &lt;/IdleSettings&gt;
31    &lt;AllowStartOnDemand&gt;true&lt;/AllowStartOnDemand&gt;
32    &lt;Enabled&gt;true&lt;/Enabled&gt;
33    &lt;Hidden&gt;false&lt;/Hidden&gt;
34    &lt;RunOnlyIfIdle&gt;false&lt;/RunOnlyIfIdle&gt;
35    &lt;WakeToRun&gt;false&lt;/WakeToRun&gt;
36    &lt;ExecutionTimeLimit&gt;PT72H&lt;/ExecutionTimeLimit&gt;
37    &lt;Priority&gt;7&lt;/Priority&gt;
38  &lt;/Settings&gt;
39  &lt;Actions Context="Author"&gt;
40    &lt;Exec&gt;
41      &lt;Command&gt;C:\Windows\System32\CompMgmtLauncher.exe&lt;/Command&gt;
42    &lt;/Exec&gt;
43  &lt;/Actions&gt;
44&lt;/Task&gt;</Data><Data Name='ClientProcessStartKey'>185773484629040073</Data><Data Name='ClientProcessId'>6916</Data><Data Name='ParentProcessId'>3192</Data><Data Name='RpcCallClientLocality'>0</Data><Data Name='FQDN'>testlab-win-dc.attackrange.local</Data></EventData></Event>

Required Output Fields

dest

Source: GitHub | Version: 5

Data Source: Windows Event Log Security 4698

Description

Details

Related Detections

Supported Apps

Event Fields

Example Log

Required Output Fields