Event ID 4702 — A scheduled task was updated.

Provider: Microsoft-Windows-Security-Auditing
Channel: Security
Audit Policy: Object Access → Other Object Access Events
Collection Priority: Recommended (Yamato Security, others)
Opcode: Info

Description

A scheduled task was updated.

Message #

A scheduled task was updated.

Subject:
	Security ID: %1
	Account Name: %2
	Account Domain: %3
	Logon ID: %4

Task Information:
	Task Name: %5
	Task New Content: %6

Fields #

Name	Description
`Security_ID`	[Subject] Security ID.
`Account_Name`	[Subject] Account Name.
`Account_Domain`	[Subject] Account Domain.
`Logon_ID`	[Subject] Logon ID.
`Task_Name`	[Task Information] Task Name.
`Task_New_Content`	[Task Information] Task New Content.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Auditing",
    "guid": "54849625-5478-4994-A5BA-3E3B0328C30D",
    "event_source_name": "",
    "event_id": 4702,
    "version": 0,
    "level": 0,
    "task": 12804,
    "opcode": 0,
    "keywords": 9232379236109516800,
    "time_created": "2019-03-25T11:22:45.080609Z",
    "event_record_id": 198238563,
    "correlation": {},
    "execution": {
      "process_id": 444,
      "thread_id": 2260
    },
    "channel": "Security",
    "computer": "DC1.insecurebank.local",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "SubjectUserSid": "S-1-5-20",
    "SubjectUserName": "DC1$",
    "SubjectDomainName": "insecurebank",
    "SubjectLogonId": "0x3e4",
    "TaskName": "\\Microsoft\\Windows\\SoftwareProtectionPlatform\\SvcRestartTask",
    "TaskContentNew": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.4\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n  <RegistrationInfo>\r\n    <Source>$(@%systemroot%\\system32\\sppc.dll,-200)</Source>\r\n    <Author>$(@%systemroot%\\system32\\sppc.dll,-200)</Author>\r\n    <Version>1.0</Version>\r\n    <Description>$(@%systemroot%\\system32\\sppc.dll,-201)</Description>\r\n    <URI>\\Microsoft\\Windows\\SoftwareProtectionPlatform\\SvcRestartTask</URI>\r\n    <SecurityDescriptor>D:P(A;;FA;;;SY)(A;;FA;;;BA)(A;;FA;;;S-1-5-80-123231216-2592883651-3715271367-3753151631-4175906628)(A;;FR;;;S-1-5-87-2912274048-3994893941-1669128114-1310430903-1263774323)</SecurityDescriptor>\r\n  </RegistrationInfo>\r\n  <Triggers>\r\n    <CalendarTrigger>\r\n      <StartBoundary>2019-03-26T11:21:44Z</StartBoundary>\r\n      <Enabled>true</Enabled>\r\n      <ScheduleByDay>\r\n        <DaysInterval>1</DaysInterval>\r\n      </ScheduleByDay>\r\n    </CalendarTrigger>\r\n  </Triggers>\r\n  <Principals>\r\n    <Principal id=\"NetworkService\">\r\n      <UserId>S-1-5-20</UserId>\r\n      <RunLevel>LeastPrivilege</RunLevel>\r\n    </Principal>\r\n  </Principals>\r\n  <Settings>\r\n    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>\r\n    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n    <AllowHardTerminate>false</AllowHardTerminate>\r\n    <StartWhenAvailable>true</StartWhenAvailable>\r\n    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n    <IdleSettings>\r\n      <StopOnIdleEnd>true</StopOnIdleEnd>\r\n      <RestartOnIdle>false</RestartOnIdle>\r\n    </IdleSettings>\r\n    <AllowStartOnDemand>true</AllowStartOnDemand>\r\n    <Enabled>true</Enabled>\r\n    <Hidden>true</Hidden>\r\n    <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n    <DisallowStartOnRemoteAppSession>false</DisallowStartOnRemoteAppSession>\r\n    <UseUnifiedSchedulingEngine>true</UseUnifiedSchedulingEngine>\r\n    <WakeToRun>false</WakeToRun>\r\n    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n    <Priority>7</Priority>\r\n    <RestartOnFailure>\r\n      <Interval>PT1M</Interval>\r\n      <Count>3</Count>\r\n    </RestartOnFailure>\r\n  </Settings>\r\n  <Actions Context=\"NetworkService\">\r\n    <ComHandler>\r\n      <ClassId>{B1AEBB5D-EAD9-4476-B375-9C3ED9F32AFC}</ClassId>\r\n      <Data><![CDATA[timer]]></Data>\r\n    </ComHandler>\r\n  </Actions>\r\n</Task>"
  }
}

Detection Patterns #

Scheduled Task With Suspicious

Security-Auditing Event ID 4698: A scheduled task was created.ANDEvent ID 4700: A scheduled task was enabled.ANDEvent ID 4702: A scheduled task was updated.

2 rules

Splunk

Windows Scheduled Task with Suspicious Command (source)

Steven Dick

Windows Scheduled Task with Suspicious Name (source)

Steven Dick

Lateral Movement: Exploitation of Remote Services

Security-Auditing Event ID 4624: An account was successfully logged on.→Event ID 4688: A new process has been created.→Event ID 4697: A service was installed in the system.→Event ID 4698: A scheduled task was created.→Event ID 4699: A scheduled task was deleted.→Event ID 4700: A scheduled task was enabled.→Event ID 4701: A scheduled task was disabled.→Event ID 4702: A scheduled task was updated.→Event ID 5145: A network share object was checked to see whether client can be granted desired access.

1 rule

Kusto Query Language

Gain Code Execution on ADFS Server via SMB + Remote Service or Scheduled Task (source)

Community Notes #

May indicate path or trigger edits.

Detection Rules #

View all rules referencing this event →

Sigma # view in reference

Suspicious Scheduled Task Update source high: Detects update to a scheduled task event that contain suspicious keywords.

Elastic # view in reference

Unusual Scheduled Task Update source low: Identifies first-time modifications to scheduled tasks by user accounts, excluding system activity and machine accounts.

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4702
Microsoft Learn Audit Policy https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4702
Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx