Event ID 4702ScheduledTaskP2
Windows Event ID 4702: A scheduled task was updated
Event ID 4702 records modification of a scheduled task definition.
- Applicable version
- Windows Server 2016 and later; Windows 10 and later
- Last reviewed
- 2026-07-11
Trigger Scenarios
Task Scheduler auditing logs the event when a registered task is changed.
Key Fields
Task Name
The changed task identifier.
Task Content
Compare the XML before and after; Command, Arguments, Principal, and Trigger are decisive.
Subject
The identity applying the change.
Common False Positives
- Management products update their scheduled tasks.
- Administrators revise approved maintenance tasks.
Related Events
MITRE ATT&CK Mapping
- T1053.005Scheduled Task/Job: Scheduled Task
Detection Notes
T1053.005 modification is indicated when Task Content changes <Command> to powershell.exe, cmd.exe, mshta.exe, or a C:\\ProgramData\\ / C:\\Users\\ executable, or changes Principal to SYSTEM. Compare before-and-after XML, not the task name alone.
SecurityEvent
| where EventID == 4702
| project TimeGenerated, Computer, Account, TaskName, TaskContentindex=wineventlog EventCode=4702 | table _time, host, SubjectUserName, TaskName, TaskContentTask Name: \Microsoft\Windows\Update\CacheRefresh
Task Content: <Command>powershell.exe</Command>
Subject: CORP\admin.ops