Windows Event ID 4698

One-liner: A Windows Security Event logged when a new scheduled task is created—critical for detecting persistence mechanisms implanted by attackers.

🎯 What Is It?

Windows Event ID 4698 is generated when a new scheduled task is registered on a Windows system. Attackers abuse scheduled tasks to:

• Maintain persistence — Execute malware on reboot/login
• Execute payloads — Run commands at specific times
• Evade detection — Tasks run as SYSTEM or specified users
• Establish C2 — Regularly beacon to command servers

Channel: Security
MITRE ATT&CK: T1053.005 - Scheduled Task/Job: Scheduled Task

Prerequisite: Requires "Audit Other Object Access Events" to be enabled.

🔬 How It Works

Event Details

<Event>
  <System>
    <EventID>4698</EventID>
    <Channel>Security</Channel>
    <Computer>WKSTN-1.domain.local</Computer>
  </System>
  <EventData>
    <Data Name="SubjectUserName">attacker</Data>
    <Data Name="SubjectDomainName">DOMAIN</Data>
    <Data Name="TaskName">\Windows Update</Data>
    <Data Name="TaskContent">
      <!-- Full XML of the scheduled task -->
    </Data>
  </EventData>
</Event>

Key Fields

Common Attacker Techniques

# Command Prompt
schtasks /create /tn "Windows Update" /tr "C:\Windows\Temp\malware.exe" /sc minute /mo 1

# PowerShell
Register-ScheduledTask -TaskName "Updater" -Trigger (New-ScheduledTaskTrigger -AtStartup) -Action (New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-enc <payload>")

🕵️ Detection & Hunting

KQL Query (from THM Threat Hunting Foothold)

host.name: WKSTN-* AND (winlog.event_id: 4698 OR (*schtasks* OR *Register-ScheduledTask*))

Key Columns to Add

• winlog.computer_name
• user.name
• process.command_line
• winlog.event_id
• winlog.event_data.TaskName

Suspicious Indicators

Example from THM

Task Name: "Windows Update"
Action: PowerShell downloading from www[.]oneedirve[.]xyz
Schedule: Every minute

→ Clear indicator of malicious persistence

📊 Related Event IDs

🔧 Enabling the Audit

Via Group Policy

Computer Configuration
  → Windows Settings
    → Security Settings
      → Advanced Audit Policy Configuration
        → Object Access
          → Audit Other Object Access Events: Success, Failure

Via Command Line

auditpol /set /subcategory:"Other Object Access Events" /success:enable /failure:enable

🎤 Interview Angles

Common Questions

• "How do you detect malicious scheduled tasks?"
• "What Event ID tracks scheduled task creation?"
• "How do attackers use scheduled tasks for persistence?"

STAR Story

Situation: Endpoint was beaconing to an external domain every minute, but no obvious malware process was visible.
Task: Identify the persistence mechanism maintaining the C2 connection.
Action: Searched for Event ID 4698 and found a task named "Windows Update" created shortly after initial compromise. The TaskContent XML revealed a PowerShell command downloading from a malicious domain. Correlated with schtasks.exe execution in Sysmon logs.
Result: Identified and removed the persistence mechanism. Created detection rule for tasks executing encoded PowerShell or connecting to external URLs.

✅ Best Practices

• Enable "Audit Other Object Access Events" on all endpoints
• Alert on scheduled task creation outside of change windows
• Monitor for tasks with suspicious names mimicking Windows
• Check TaskContent for encoded commands or external URLs
• Correlate with process creation (schtasks.exe, powershell.exe)

❌ Common Misconceptions

• "Only admins can create scheduled tasks" — Users can create tasks in their context
• "Scheduled tasks are always visible in Task Scheduler GUI" — Attackers can hide tasks
• "Event ID 4698 shows the command" — Need to parse TaskContent XML

🔗 Related Concepts

• Windows Event Logs
• Persistence (Cyber Security)
• MITRE ATT&CK
• Threat Hunting
• Sysmon Event IDs
• Defense Evasion

📚 References

• MITRE ATT&CK T1053.005: https://attack.mitre.org/techniques/T1053/005/
• Microsoft Audit Other Object Access Events
• SANS Windows Security Event Log Reference