Event ID 4698: scheduled task created
What Event ID 4698 (scheduled task created) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.
Event ID 4698 is written when a scheduled task is created. Tasks are one of the most common ways attackers stay on a machine after a reboot, and the event includes the full task definition, so you can see exactly what will run.
The fields that matter
| Field | What it tells you |
|---|---|
| Task Name | Path and name, such as \Microsoft\Windows\UpdateCheck. |
| Task Content | The task XML: look at Command, Arguments, the triggers and the account it runs as. |
| Subject | The account that created it. |
What is normal
Updaters for browsers, Office, OneDrive and drivers, and tasks created by your own management tools.
When Event ID 4698 is suspicious
- A command in
AppData,Temp,ProgramDataorUsers\Public. - Arguments with
powershell -enc,cmd /c,mshtaor a URL. - Names that imitate Microsoft tasks but sit outside the usual folders, or random names.
- Tasks that run as SYSTEM created by a normal user account, or created remotely.
Common false positive: Software installs create tasks too. Check the publisher of the target file before raising it.
Find Event ID 4698 with PowerShell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4698; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
ForEach-Object {
$d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
[pscustomobject]$d
} | Format-ListMicrosoft Sentinel (KQL)
SecurityEvent
| where TimeGenerated > ago(7d) and EventID == 4698
| project TimeGenerated, Computer, Account, Activity, EventData
| order by TimeGenerated descRelated events
- Event ID 4688: New process created
- System Event ID 7045: New service installed
- Event ID 4699: Scheduled task deleted
- Event ID 4702: Scheduled task updated
FAQ
Why don't I see 4698 events?
"Audit Other Object Access Events" must be enabled (Advanced Audit Policy > Object Access). Without it Windows does not log task creation in the Security log.
What are 4699 and 4702?
4699 is a task deleted and 4702 a task updated. Attackers sometimes modify an existing task instead of creating one, so watch 4702 too.
Windows Event Triage reads a CSV, EVTX-to-JSON or XML export in your browser and flags brute force, new admins, suspicious services and log clearing.
IOC Triage, our free browser extension: right-click it for a verdict from 15 threat-intel sources, then copy a ready ticket note.