Detection of Rapid Creation and Deletion of Windows Scheduled Tasks

Adversaries frequently target the Windows Task Scheduler to gain persistence and execute payloads under the context of elevated system accounts. To evade detection, sophisticated attackers employ a technique of creating a task to trigger a malicious script or binary and subsequently deleting the task within a very short timeframe. This behavior aims to reduce the window of opportunity for security tools and analysts to inspect the scheduled task configuration, its associated command lines, or its triggers. By observing the sequence of task creation followed immediately by task deletion on the same host, security teams can identify potentially unauthorized administrative activity or malicious proxy execution. This behavior is often characteristic of post-exploitation cleanup or the execution of temporary drop-exec payloads.

Impact

Successful exploitation of this technique allows an attacker to achieve code execution or maintain persistence on a target system. Because the task is ephemeral, standard forensic analysis of the registry or task XML files may fail if the task is deleted before the next logging interval or alert triage. This technique increases the likelihood of an attacker establishing a foothold without leaving behind persistent, easily discoverable indicators.

Recommendation

Prioritized, concrete actions for detection engineering teams:

• Enable Windows "Audit Other Object Access Events" to ensure Event IDs 4698 (Task Created) and 4699 (Task Deleted) are logged.
• Deploy the provided Sigma rule to your SIEM to monitor for rapid task creation and deletion within a 5-minute window.
• Review and baseline existing administrative tasks or automated maintenance scripts that perform these actions to reduce false positive noise in the SIEM.
• Investigate alerts triggered by this rule by correlating the User Name and Task Name against known-good inventory and administrative account activity.