detection.wiki

Microsoft-Windows-TaskScheduler › Event 322

Event ID 322 — Task Scheduler did not launch task "Name" because instance "TaskName" of the same task is already running.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Warning
Collection Priority
Recommended (Yamato Security)
Task
Launchrequestignored,instancealreadyrunning

Description

Task Scheduler did not launch task "Name" because instance "TaskName" of the same task is already running.

Message #

Task Scheduler did not launch task "%1"  because instance "%2"  of the same task is already running.

Fields #

NameDescription
Name—
TaskName UnicodeString—
TaskInstanceId GUID—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 322,
    "version": 0,
    "level": 3,
    "task": 322,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T00:37:25.158852+00:00",
    "event_record_id": 819,
    "correlation": {
      "ActivityID": "3428C28C-0C94-487C-AC7E-0E29218A38C7"
    },
    "execution": {
      "process_id": 1392,
      "thread_id": 13712
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "NewInstanceIgnored",
    "TaskName": "\\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Scan Static Task",
    "TaskInstanceId": "3428C28C-0C94-487C-AC7E-0E29218A38C7"
  },
  "message": ""
}

References #