SOC Event Lookup
Event ID 4699ScheduledTaskP2

Windows Event ID 4699: A scheduled task was deleted

Applicable version
Windows Server 2016 and later; Windows 10 and later
Last reviewed
2026-07-21

Quick summary

Event ID 4699 records deletion of a scheduled task.

Technical Metadata

Technical metadata for Event ID 4699
Event ID4699
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0005 Defense Evasion / T1070.009 Indicator Removal: Clear Persistence
Key fields to watchTask Name, Subject, Task Content

Trigger Scenarios

It is generated when Task Scheduler auditing records task removal.

Key Fields

Task Name

The deleted task path; preserve it for comparison with known baselines.

Subject

The account deleting the task.

Task Content

Where retained, identifies the removed command and trigger.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Event ID 4699
SecurityEvent
| where EventID == 4699
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Windows Event ID 4699
index=wineventlog source="WinEventLog:Security" EventCode=4699
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
Cortex XQL: Retrieve Windows Event ID 4699
dataset = microsoft_windows_raw
| filter edr_event_id = 4699
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4699
title: Windows Security Event ID 4699
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4699
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

MITRE ATT&CK Mapping

  • T1070.009Indicator Removal: Clear Persistence

Detection Notes

T1070.009 Clear Persistence is indicated when TaskName deleted by 4699 matches a suspicious task previously created in 4698 or updated in 4702 and its TaskContent referenced powershell.exe or a C:\Users\ path. Use an environment-defined correlation window based on task retention, preserve the earlier XML, and distinguish attacker cleanup from approved software removal.

Common False Positives

  • Software updaters remove obsolete tasks.
  • Administrators clean up maintenance tasks.

Related Events

Sample Log

Sanitized event sample
Task Name: \Microsoft\Windows\Update\CacheRefresh
Subject: CORP\admin.ops

Frequently Asked Questions

What does Windows Event ID 4699 mean?

Event ID 4699 records deletion of a scheduled task and identifies the actor and task name; newer event versions can include task XML content.

Are scheduled-task deletions malicious?

No. Software upgrades, uninstallers, Windows maintenance, and administrators routinely remove tasks; risk depends on who deleted what and whether the task was recently used for suspicious execution.

How can Event ID 4699 show clear-persistence behavior?

Correlate TaskName with 4698 creation and 4702 modification, preserve the earlier task XML, and determine whether an actor removed its own execution mechanism after use.

Sources