detection.wiki

Microsoft-Windows-Security-Auditing › Event 4699

Event ID 4699 — A scheduled task was deleted.

Provider
Microsoft-Windows-Security-Auditing
Channel
Security
Audit Policy
Object Access → Other Object Access Events
Collection Priority
Recommended (Palantir, others)
Opcode
Info

Description

A scheduled task was deleted.

Message #

A scheduled task was deleted.

Subject:
	Security ID: %1
	Account Name: %2
	Account Domain: %3
	Logon ID: %4

Task Information:
	Task Name: %5
	Task Content: %6

Fields #

NameDescription
Security_ID[Subject] Security ID.
Account_Name[Subject] Account Name.
Account_Domain[Subject] Account Domain.
Logon_ID[Subject] Logon ID.
Task_Name[Task Information] Task Name.
Task_Content[Task Information] Task Content.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Auditing",
    "guid": "54849625-5478-4994-A5BA-3E3B0328C30D",
    "event_source_name": "",
    "event_id": 4699,
    "version": 0,
    "level": 0,
    "task": 12804,
    "opcode": 0,
    "keywords": 9232379236109516800,
    "time_created": "2019-03-19T00:02:04.351252Z",
    "event_record_id": 566840,
    "correlation": {},
    "execution": {
      "process_id": 452,
      "thread_id": 2836
    },
    "channel": "Security",
    "computer": "WIN-77LTAPHIQ1R.example.corp",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "SubjectUserSid": "S-1-5-21-1587066498-1489273250-1035260531-500",
    "SubjectUserName": "Administrator",
    "SubjectDomainName": "EXAMPLE",
    "SubjectLogonId": "0x17e2d2",
    "TaskName": "\\CYAlyNSS",
    "TaskContent": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n  <Triggers>\r\n    <CalendarTrigger>\r\n      <StartBoundary>2015-07-15T20:35:13.2757294</StartBoundary>\r\n      <Enabled>true</Enabled>\r\n      <ScheduleByDay>\r\n        <DaysInterval>1</DaysInterval>\r\n      </ScheduleByDay>\r\n    </CalendarTrigger>\r\n  </Triggers>\r\n  <Principals>\r\n    <Principal id=\"LocalSystem\">\r\n      <UserId>S-1-5-18</UserId>\r\n      <RunLevel>HighestAvailable</RunLevel>\r\n      <LogonType>InteractiveToken</LogonType>\r\n    </Principal>\r\n  </Principals>\r\n  <Settings>\r\n    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>\r\n    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n    <AllowHardTerminate>true</AllowHardTerminate>\r\n    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n    <IdleSettings>\r\n      <StopOnIdleEnd>true</StopOnIdleEnd>\r\n      <RestartOnIdle>false</RestartOnIdle>\r\n    </IdleSettings>\r\n    <AllowStartOnDemand>true</AllowStartOnDemand>\r\n    <Enabled>true</Enabled>\r\n    <Hidden>true</Hidden>\r\n    <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n    <WakeToRun>false</WakeToRun>\r\n    <ExecutionTimeLimit>P3D</ExecutionTimeLimit>\r\n    <Priority>7</Priority>\r\n  </Settings>\r\n  <Actions Context=\"LocalSystem\">\r\n    <Exec>\r\n      <Command>cmd.exe</Command>\r\n      <Arguments>/C tasklist &gt; %windir%\\Temp\\CYAlyNSS.tmp 2&gt;&amp;1</Arguments>\r\n    </Exec>\r\n  </Actions>\r\n</Task>"
  }
}

Detection Patterns #

References #