detection.wiki

Microsoft-Windows-TaskScheduler › Event 324

Event ID 324 — Task Scheduler queued instance "TaskName" of task "Name" and will launch it as soon as instance "QueuedTaskInstanceId" completes.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Warning
Collection Priority
Recommended (Yamato Security)
Task
Launchrequestqueued,instancealreadyrunning

Description

Task Scheduler queued instance "TaskName" of task "Name" and will launch it as soon as instance "QueuedTaskInstanceId" completes.

Message #

Task Scheduler queued instance "%2"  of task "%1"  and will launch it as soon as instance "%3"  completes.

Fields #

NameDescription
Name—
TaskName UnicodeString—
QueuedTaskInstanceId GUID—
RunningTaskInstanceId GUID—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 324,
    "version": 0,
    "level": 3,
    "task": 324,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T01:41:42.776465+00:00",
    "event_record_id": 999,
    "correlation": {
      "ActivityID": "A0104592-5DBE-4AC7-B2A0-2CB2CC5B61A3"
    },
    "execution": {
      "process_id": 1392,
      "thread_id": 12756
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "NewInstanceQueued",
    "TaskName": "\\microsoft\\windows\\applicationdata\\appuriverifierinstall",
    "QueuedTaskInstanceId": "A0104592-5DBE-4AC7-B2A0-2CB2CC5B61A3",
    "RunningTaskInstanceId": "B5155744-8897-4FDF-AC62-B9A099F510CF"
  },
  "message": ""
}

References #