Event ID 4698: a scheduled task was created

A scheduled task that runs a program at startup or every few minutes is one of the favourite ways for an attacker to come back after a reboot or a password change. Event 4698 records every new task – including the full task definition, so you see exactly what it runs, when and as which user.

In short

What it is: a new scheduled task, with its full XML in the field Task Content.
Off by default: audit subcategory Other Object Access Events.
Related: 4699 deleted, 4700 enabled, 4701 disabled, 4702 updated.
Suspicious: a task running powershell, cmd or a program from a user or Temp folder, as SYSTEM, at startup or every few minutes, with an odd or Microsoft-like name.

1. Switch it on

auditpol /set /subcategory:"{0CCE9227-69AE-11D9-BED3-505054503030}" /success:enable

That is Other Object Access Events (in Group Policy under Advanced Audit Policy Configuration › Object Access). Without it you can still look at the Microsoft-Windows-TaskScheduler/Operational log (Event 106 = task registered), if that log is enabled.

2. PowerShell: new tasks and what they run

function Get-EventFields($e) { $d = [ordered]@{}; ([xml]$e.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }; [pscustomobject]$d }
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4698,4702; StartTime=(Get-Date).AddDays(-30)} -ErrorAction SilentlyContinue |
  ForEach-Object { $f = Get-EventFields $_; $x = [xml]$f.TaskContent
    [pscustomobject]@{ Time = $_.TimeCreated; Event = $_.Id; By = $f.SubjectUserName; Task = $f.TaskName
      RunsAs = $x.Task.Principals.Principal.UserId; Runs = ($x.Task.Actions.Exec | ForEach-Object { "$($_.Command) $($_.Arguments)" }) -join ' | ' } } |
  Format-List

And all tasks that exist right now, outside the Microsoft folder:

Get-ScheduledTask | Where-Object TaskPath -notlike '\Microsoft\*' |
  Select-Object TaskPath, TaskName, State, @{n='Runs';e={($_.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }) -join ' | '}}

3. Normal or attack?

Normal: updaters of installed software (browsers, Adobe, drivers), backup tools, tasks your IT deploys by Group Policy.
Suspicious: created by a user account that never manages tasks; a name that imitates Windows (WindowsUpdateCheck, MicrosoftEdgeUpdateTaskCore2) but outside \Microsoft\; running powershell -enc, cmd /c, mshta or a program from AppData, Temp or ProgramData; triggers at logon, at startup or every few minutes; running as SYSTEM.

If you find one: disable it (Disable-ScheduledTask), keep a copy of its XML, check the program it runs, and look for how it got there – the account in Subject and its logons.

4. Let Coinetic watch it for you

Coinetic keeps the network side of a Server or PC in shape, so attackers rarely get as far as this:

A security check with plain explanations: open ports, risky settings and firewall rules nobody needs any more – each with a severity and a fix you can undo.
Firewall change watch: if something switches the firewall off or opens a port to everyone, Coinetic alerts you and names the program.
Logging kept on: Coinetic keeps the audit settings and the Security log size it needs, and reports audit settings that flood the log.
Ask AI (Pro + AI): “Which finding of the security check should I fix first, and why?”

Protect this Server or PC in 5 minutes

Download Coinetic, install, done: it starts protecting at once. 30 days free with all features, no payment details. From $20 per computer per year.

Start the free 30-day trial →

More guides: all Coinetic guides.

Frequently asked

Where is the program the task runs?

In the task XML in the event (Task Content, element Actions/Exec/Command). The PowerShell above extracts it.

Why do I see 4702 every day for the same task?

Some software updates its own tasks regularly (browsers, Office). Compare the content: if only times change, it is normal.

Does deleting the task remove the attacker?

No. The task is only the way back. Find the program it runs, how the attacker got in, and change the passwords that may be known.