Detection rules › Splunk

Short Lived Scheduled Task

Author
Mauricio Velazco, Splunk
Source
upstream

The following analytic detects the creation and deletion of scheduled tasks within a short time frame (less than 30 seconds) using Windows Security EventCodes 4698 and 4699. This behavior is identified by analyzing Windows Security Event Logs and leveraging the Windows TA for parsing. Such activity is significant as it may indicate lateral movement or remote code execution attempts by adversaries. If confirmed malicious, this could lead to unauthorized access, data exfiltration, or execution of malicious payloads, necessitating prompt investigation and response by security analysts.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1053.005 Scheduled Task/Job: Scheduled Task
PersistenceT1053.005 Scheduled Task/Job: Scheduled Task
Privilege EscalationT1053.005 Scheduled Task/Job: Scheduled Task

Event coverage

ProviderEvent IDTitle
Security-Auditing4698A scheduled task was created.
Security-Auditing4699A scheduled task was deleted.

Stages and Predicates

Stage 1: search

search (EventCode=4698 OR EventCode=4699)

Stage 2: xmlkv

xmlkv

Stage 3: transaction

transaction Task_Name endswith=EventCode = 4699 startswith=EventCode = 4698

Stage 4: eval

eval ... using (duration)

Stage 5: search

search short_lived=TRUE

Stage 6: rename

rename

Stage 7: table

table Account_Name, Command, Task_Name, _time, dest, short_lived

Stage 8: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventCodeeq
  • 4698 corpus 8 (splunk 8)
  • 4699
short_livedeq
  • TRUE corpus 4 (splunk 4)

Neighbors

Often fire together

Rules that target events appearing in the same incident timelines. They pattern-match on adjacent steps of the same TTP, so an alert from one is often paired with alerts from these. Useful for triage context and for assembling chained-detection rules.

Share event IDs (chain-detection candidates)

Rules that observe the same Windows event-ID pairs as this one. If you're authoring a multi-stage / sequence rule that spans these events, these are the existing detections that already cover one or both endpoints.