Windows Event ID 4698 – Microsoft-Windows-Security-Auditing: Scheduled Task Created

Start by examining the event details to understand what task was created and by whom.

1. Open Event Viewer by pressing Win+R, typing eventvwr.msc
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4698 by right-clicking Security log → Filter Current Log
4. Enter 4698 in the Event IDs field and click OK
5. Double-click on a 4698 event to view details
6. Review the General tab for basic information including Subject (who created it) and Task Name
7. Click the Details tab and select XML View to see the complete task definition
8. Look for suspicious execution paths, unusual triggers, or tasks created by unexpected users

Use PowerShell to efficiently query and analyze scheduled task creation events across time ranges.

1. Open PowerShell as Administrator
2. Query recent task creation events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4698} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. Filter events by specific user or time range:

   $StartTime = (Get-Date).AddDays(-7)
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4698; StartTime=$StartTime}
   $Events | ForEach-Object {
       $XML = [xml]$_.ToXml()
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           User = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
           TaskName = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'TaskName'} | Select-Object -ExpandProperty '#text'
           TaskContent = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'TaskContent'} | Select-Object -ExpandProperty '#text'
       }
   }

4. Export results for analysis:

   $Events | Export-Csv -Path "C:\Temp\ScheduledTaskCreation.csv" -NoTypeInformation

Examine the actual scheduled task configuration to determine if it represents legitimate activity or potential security threat.

1. Extract task XML content from the event and save to file:

   $Event = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4698} -MaxEvents 1
   $XML = [xml]$Event.ToXml()
   $TaskXML = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'TaskContent'} | Select-Object -ExpandProperty '#text'
   $TaskXML | Out-File -FilePath "C:\Temp\TaskDefinition.xml"

2. Open the XML file and examine key elements:
   • Actions: Look for PowerShell, cmd.exe, or suspicious executables
   • Triggers: Check for unusual timing or system event triggers
   • Principal: Verify the security context (SYSTEM, specific users)
   • Settings: Review execution limits and failure handling
3. Cross-reference with current scheduled tasks:

   Get-ScheduledTask | Where-Object {$_.TaskName -like "*SuspiciousName*"} | Get-ScheduledTaskInfo

4. Check task execution history:

   Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-TaskScheduler/Operational'; Id=200,201} | Where-Object {$_.Message -like "*TaskName*"}

5. Validate file paths and digital signatures of executables referenced in task actions

Set up proactive monitoring to detect suspicious scheduled task creation in real-time.

1. Enable detailed Task Scheduler logging:

   wevtutil sl Microsoft-Windows-TaskScheduler/Operational /e:true
   wevtutil sl Microsoft-Windows-TaskScheduler/Maintenance /e:true

2. Create a custom Event Viewer view for task creation monitoring:
   • In Event Viewer, right-click Custom Views → Create Custom View
   • Select By log → Windows Logs → Security
   • Add Event ID 4698 and optionally 4699 (task deleted) and 4700 (task enabled)
   • Save as "Scheduled Task Changes"
3. Set up PowerShell-based monitoring script:

   # Save as ScheduledTaskMonitor.ps1
   Register-WmiEvent -Query "SELECT * FROM Win32_NTLogEvent WHERE LogFile='Security' AND EventCode=4698" -Action {
       $Event = $Event.SourceEventArgs.NewEvent
       $Message = "New scheduled task created: " + $Event.Message
       Write-EventLog -LogName Application -Source "TaskMonitor" -EventId 1001 -Message $Message -EntryType Warning
       # Add email notification or SIEM integration here
   }

4. Configure Windows Event Forwarding (WEF) for centralized collection in enterprise environments
5. Integrate with SIEM platforms using Windows Event Collector or agent-based forwarding

Perform detailed forensic analysis when Event ID 4698 indicates potential security incidents.

1. Correlate with other security events:

   # Look for related logon events around task creation time
   $TaskEvent = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4698} -MaxEvents 1
   $TimeWindow = $TaskEvent.TimeCreated
   $StartTime = $TimeWindow.AddMinutes(-30)
   $EndTime = $TimeWindow.AddMinutes(30)
   
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625,4648; StartTime=$StartTime; EndTime=$EndTime} | Format-Table TimeCreated, Id, Message

2. Extract and analyze task artifacts:

   # Export task definition for forensic analysis
   $XML = [xml]$TaskEvent.ToXml()
   $TaskContent = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'TaskContent'} | Select-Object -ExpandProperty '#text'
   $TaskContent | Out-File "C:\Forensics\Task_$(Get-Date -Format 'yyyyMMdd_HHmmss').xml"
   
   # Check if task still exists
   $TaskName = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'TaskName'} | Select-Object -ExpandProperty '#text'
   Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue

3. Examine file system artifacts:
   • Check task executable locations for suspicious files
   • Review file creation timestamps and digital signatures
   • Analyze parent process that created the task using Process Monitor or similar tools
4. Document findings and create incident timeline:

   # Generate comprehensive report
   $Report = @{
       EventTime = $TaskEvent.TimeCreated
       TaskName = $TaskName
       CreatedBy = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
       TaskXML = $TaskContent
       RelatedEvents = $RelatedEvents
   }
   $Report | ConvertTo-Json -Depth 10 | Out-File "C:\Forensics\TaskCreationIncident.json"

5. Implement containment measures if malicious activity is confirmed:
   • Disable or delete suspicious scheduled tasks
   • Block execution of identified malicious files
   • Reset compromised user credentials
   • Update security policies to prevent similar incidents