Windows Event ID 4698: A scheduled task was created
Windows Security Event ID 4698 records creation of a scheduled task and supports detection of task-based persistence and execution.
- Applicable version
- Windows Server 2016 and later; Windows 10 and later
- Last reviewed
- 2026-07-10
Trigger Scenarios
The event is written when a scheduled task is registered and Task Scheduler auditing is enabled.
Key Fields
Task Name
The task path and name. Hidden-looking names, names that imitate Microsoft tasks, and new tasks on servers are useful pivots.
Task Content
The XML task definition includes command, arguments, trigger, principal, and run level.
Subject
The creating account. Review whether its role and logon context authorize task creation.
Common False Positives
- Enterprise management agents and software updaters create scheduled tasks.
- Administrators and developers may create one-time maintenance tasks.
Related Events
MITRE ATT&CK Mapping
- T1053.005Scheduled Task/Job: Scheduled Task
Detection Notes
T1053.005 is concrete when Task Content sets <Command>powershell.exe</Command>, mshta.exe, or a C:\\Users\\ / C:\\ProgramData\\ path, or sets <RunLevel>HighestAvailable</RunLevel> or SYSTEM. Those XML values establish executable persistence, not merely an unusual Task Name.
SecurityEvent
| where EventID == 4698
| project TimeGenerated, Computer, Account, TaskName, TaskContent
| order by TimeGenerated descindex=wineventlog EventCode=4698
| table _time, host, SubjectUserName, TaskName, TaskContentTask Name: \Microsoft\Windows\Update\CacheRefresh
Task Content: <Exec><Command>powershell.exe</Command><Arguments>-File C:\Users\Public\refresh.ps1</Arguments></Exec>
Subject: CORP\admin.ops