SOC Event Lookup
Event ID 4698ScheduledTaskP1

Windows Event ID 4698: A scheduled task was created

Applicable version
Windows Server 2016 and later; Windows 10 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 4698 records creation of a scheduled task and supports detection of task-based persistence and execution.

Technical Metadata

Technical metadata for Event ID 4698
Event ID4698
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0003 Persistence / T1053.005 Scheduled Task/Job: Scheduled Task
Key fields to watchTask Name, Task Content, Subject

Trigger Scenarios

The event is written when a scheduled task is registered and Task Scheduler auditing is enabled.

Key Fields

Task Name

The task path and name. Hidden-looking names, names that imitate Microsoft tasks, and new tasks on servers are useful pivots.

Task Content

The XML task definition includes command, arguments, trigger, principal, and run level.

Subject

The creating account. Review whether its role and logon context authorize task creation.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Event ID 4698
SecurityEvent
| where EventID == 4698
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Microsoft Sentinel Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Event ID 4698
index=wineventlog source="WinEventLog:Security" EventCode=4698
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before implementing event-specific filtering or aggregation.
Cortex XQL: Retrieve Event ID 4698
dataset = microsoft_windows_raw
| filter edr_event_id = 4698
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The relevant Windows event channel is ingested through a Cortex XDR Windows event collection path. Inspect raw provider fields because parsed field names vary by collection path and event provider.
Query reference
Sigma rule: Windows Event ID 4698
title: Windows Event ID 4698
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4698
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
TaskContent/RunLevelHighestAvailableThe task requests the highest privilege level available to its principal.Pair this value with the task principal and executable path to identify elevated persistence rather than treating the value alone as malicious. Source

MITRE ATT&CK Mapping

  • T1053.005Scheduled Task/Job: Scheduled Task

Detection Notes

T1053.005 is concrete when Task Content sets <Command>powershell.exe</Command>, mshta.exe, or a C:\\Users\\ / C:\\ProgramData\\ path, or sets <RunLevel>HighestAvailable</RunLevel> or SYSTEM. Those XML values establish executable persistence, not merely an unusual Task Name.

Common False Positives

  • Enterprise management agents and software updaters create scheduled tasks.
  • Administrators and developers may create one-time maintenance tasks.

Related Events

Sample Log

Sanitized event sample
Task Name: \Microsoft\Windows\Update\CacheRefresh
Task Content: <Exec><Command>powershell.exe</Command><Arguments>-File C:\Users\Public\refresh.ps1</Arguments></Exec>
Subject: CORP\admin.ops

Frequently Asked Questions

What does Windows Event ID 4698 mean?

Event ID 4698 records creation of a scheduled task and includes the task name and XML task definition.

Where is the executable stored in Event ID 4698?

Inspect the TaskContent XML, especially Exec Command and Arguments elements; other task action types can appear and should also be reviewed.

Are all newly created scheduled tasks suspicious?

No. Windows, management tools, and applications create legitimate tasks; prioritize unexpected principals, elevated run levels, unusual triggers, and commands in user-writable or temporary paths.

Sources