The TaskScheduler/Operational event log channel provides detailed tracing of scheduled tasks on an endpoint.
- Behavioral - Persistence (TA0003)
- Behavioral - Lateral Movement (TA0008)
- Execution - Command Line Options
- Execution - First Executed
- Execution - Last Executed
- Execution - Evidence of Execution
- Execution - Time
- File - Path
- Network Activity - Source Identification
- Windows 11
- Windows 10
- Windows 8
- Windows 7
- Windows Server 2019
- Windows Server 2016
- Windows Server 2012 R2
- Windows Server 2012
- Windows Server 2008 R2
%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-TaskScheduler%4Operational.evtx
The following event IDs are useful to hunt for persistent implants on an endpoint:
| Event ID | Description | Information |
|---|---|---|
| 106 | Scheduled Task Created | Origin Account/User |
| 140 | Scheduled Task Updated | Origin Account/User |
| 141 | Scheduled Task Deleted | Origin Account/User |
| 200 | Scheduled Task Executed | Executable file path |
| 201 | Scheduled Task Execution Completed | Executable file path |
This activity is also logged in the Security channel with more granular information, as follows:
| Event ID | Description |
|---|---|
| 4698 | Scheduled Task Created |
| 4702 | Scheduled Task Updated |
| 4699 | Scheduled Task Deleted |
Logging for these events is disabled by default and must be enabled to provide these artifacts.
Scheduled task deletion is a rare event on Windows systems and provides an easy to query, high-fidelity indicator of suspicious activity. The following event IDs may be queried:
Windows-TaskScheduler\Operational Event 141: Scheduled Task DeletedSecurity Event 4699: Scheduled Task Deleted
When applications are installed on a Windows system, they will sometimes create a scheduled task to run their update functionality, making the Task Scheduler Operational log a possible option for cross-validation of other application installation artifacts such as the Uninstall registry key.
In the event that tasks are remotely scheduled, as is commonly seen during lateral movement attempts, this activity may be identified by observing Type 3 logons via 4624: An account was successfully logged on events in close proximity to task creation.