Don’t Let Scheduled Tasks Compromise Your Security: 4 Ways to Detect and Prevent Them

Posted on by Marcus Edmondson

Scheduled tasks are a powerful feature of Windows that allow you to automate tasks. However, they can also be a double-edged sword if they are hijacked by adversaries to launch attacks or maintain persistence.

In this post, I will reveal 4 ways to detect and prevent scheduled tasks from compromising your security.

1. Monitoring the creation and modification of scheduled tasks by using event logs.

– %SystemRoot%\System32\winevt\Logs\Microsoft-Windows-TaskScheduler\Operational log
– 4698 – Task was created
– 4699 – Task was deleted
– 4700 – Task was enabled
– 4701 – Task was disabled
– 4702 – Task was changed

2. Conducting regular audits of scheduled tasks to identify any unknown or suspicious tasks.

– Ensure the creation of scheduled tasks is tracked.
– Changes to tasks or the creation of new ones should be looked into.

3. Using built-in Windows security tools like PowerShell and schtask to query scheduled tasks and detect any anomalies.

– Get-ScheduledTask
– PowerShell-Remoting can be used to scale this out
– schtask /query /fo csv > schtasks.csv


4. Utilizing third-party security solutions that can scale detection, response and querying of suspicious scheduled tasks.

– Velociraptor
– LimaCharlie

Hopefully you learned something or found this useful.


Stay vigilant and happy hunting!

Leave a comment

Unknown's avatar

Published by Marcus Edmondson

With over fifteen years of experience in cyber security and information technology, I am an expert in digital forensics, threat hunting, and incident response. I currently work as a Cyber Network Operator at the US Department of Defense, where I use various tools and techniques in an offensive capacity on critical networks. I have a passion for hunting, forensics, and detection, and I leverage my background in offensive cyber operations to improve defenses and gain visibility into attacks. I am skilled in collecting, parsing, and analyzing security data at scale using PowerShell, Velociraptor, Elasticsearch, SQL, Python, and spreadsheet tools. I am always eager to learn and apply new techniques to find adversaries on networks. I hold eleven GIAC certifications: GCFA, GCWN, GCFE, GPEN, GCPN, GREM, GCIH, GDAT, GCTI, GWAPT and GCIA.