Scheduled-Tasks - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/scheduled-tasks/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 05 Oct 2026 12:27:59 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDetection of Malicious Windows Scheduled Task Nameshttps://feed.craftedsignal.io/briefs/2026-10-suspicious-scheduled-tasks/Mon, 05 Oct 2026 12:27:59 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-suspicious-scheduled-tasks/Detection logic targeting the creation, modification, or enabling of Windows Scheduled Tasks that utilize known malicious or suspicious naming conventions often associated with persistence and payload execution.This brief addresses the use of Windows Scheduled Tasks by threat actors to establish persistence, elevate privileges, or facilitate the execution of malicious code. Attackers frequently register tasks with specific naming patterns to mask their activity or follow naming conventions identified in previous campaigns. Defenders can identify this activity by monitoring Windows Security Event logs for task creation (4698), modification (4702), and enablement (4700). Security teams should monitor for these events and compare registered task names against internal watchlists or intelligence-derived lists of known suspicious task names. This analytic is particularly relevant for identifying techniques employed by diverse threat groups, including those associated with ransomware families like Ryuk and various information stealers.

Impact

Successful exploitation of scheduled tasks enables threat actors to maintain long-term unauthorized access to a system, execute arbitrary payloads with elevated permissions, or bypass basic security controls. This activity is a common precursor to wider network compromise, data exfiltration, or ransomware deployment. Organizations may face significant operational disruption and data loss if persistent malicious tasks remain undetected.

Recommendation

  • Enable Windows Security Event Log auditing for Task Scheduler events (Event IDs 4698, 4700, 4702) across all endpoints.
  • Implement a centralized watchlist of suspicious task names derived from threat intelligence to flag anomalous registrations.
  • Investigate any scheduled task creation that includes shell commands or binary execution paths from suspicious directories (e.g., Temp, AppData).
  • Use the provided drilldown searches to correlate alerts with user identity and system context to distinguish between administrative tasks and malicious activity.
]]>mediumadvisorypersistencescheduled-taskswindowsdetection-engineering