Detection rules › Splunk
Windows Scheduled Tasks for CompMgmtLauncher or Eventvwr
The following analytic detects the creation or modification of Windows Scheduled Tasks related to CompMgmtLauncher or Eventvwr. These legitimate system utilities, used for launching the Computer Management Console and Event Viewer, can be abused by attackers to execute malicious payloads under the guise of normal system processes. By leveraging these tasks, adversaries can establish persistence or elevate privileges without raising suspicion. This detection helps security analysts identify unusual or unauthorized scheduled tasks involving these executables, allowing for timely investigation and remediation of potential threats.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1053 Scheduled Task/Job |
| Persistence | T1053 Scheduled Task/Job |
| Privilege Escalation | T1053 Scheduled Task/Job |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Security-Auditing | 4698 | A scheduled task was created. |
Stages and Predicates
Stage 1: search
search (TaskContent="*<Command>C:\\Windows\\System32\\CompMgmtLauncher.exe</Command>*" OR TaskContent="*<Command>C:\\Windows\\System32\\eventvwr.msc</Command>*" OR TaskContent="*<Command>C:\\Windows\\System32\\zh-CN\\eventvwr.msc</Command>*") EventCode=4698
Stage 2: stats
stats BY dest, action, EventData_Xml, TaskContent, TaskName
Stage 3: search
search
Stage 4: search
search
Stage 5: search
search `macro`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
TaskContent | eq |
|
Neighbors
Broader alternatives (more inclusive than this rule)
These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.
- Suspicious Scheduled Task Creation (drops 2 filters this rule applies)
- Randomly Generated Scheduled Task Name (drops 1 filter this rule applies)
- Schedule Task with HTTP Command Arguments (drops 1 filter this rule applies)
- Schedule Task with Rundll32 Command Trigger (drops 1 filter this rule applies)