SOC Event Lookup
Event ID 4702ScheduledTaskP2

Windows Event ID 4702: A scheduled task was updated

Applicable version
Windows Server 2016 and later; Windows 10 and later
Last reviewed
2026-07-21

Quick summary

Event ID 4702 records modification of a scheduled task definition.

Technical Metadata

Technical metadata for Event ID 4702
Event ID4702
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0003 Persistence / T1053.005 Scheduled Task/Job: Scheduled Task
Key fields to watchTask Name, Task Content, Subject

Trigger Scenarios

Task Scheduler auditing logs the event when a registered task is changed.

Key Fields

Task Name

The changed task identifier.

Task Content

Compare the XML before and after; Command, Arguments, Principal, and Trigger are decisive.

Subject

The identity applying the change.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Event ID 4702
SecurityEvent
| where EventID == 4702
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Windows Event ID 4702
index=wineventlog source="WinEventLog:Security" EventCode=4702
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
Cortex XQL: Retrieve Windows Event ID 4702
dataset = microsoft_windows_raw
| filter edr_event_id = 4702
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4702
title: Windows Security Event ID 4702
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4702
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
TaskContent/Commandpowershell.exeThe updated task executes PowerShell.This is not malicious by itself, but an unexpected principal, arguments, trigger, or user-writable script path can make it an actionable scheduled-task persistence change. Source
TaskContent/RunLevelHighestAvailableThe task requests the highest privilege available to its configured principal.Compare the value with the prior task XML and principal to identify a privilege-impacting modification rather than alerting on the value alone. Source

MITRE ATT&CK Mapping

  • T1053.005Scheduled Task/Job: Scheduled Task

Detection Notes

T1053.005 Scheduled Task modification is indicated when TaskContent changes Command to powershell.exe, cmd.exe, mshta.exe, or a C:\ProgramData\ or C:\Users\ executable, or changes RunLevel to HighestAvailable under an unexpected principal. Compare before-and-after XML and correlate SubjectLogonId with 4624 rather than relying on TaskName alone.

Common False Positives

  • Management products update their scheduled tasks.
  • Administrators revise approved maintenance tasks.

Related Events

Sample Log

Sanitized event sample
Task Name: \Microsoft\Windows\Update\CacheRefresh
Task Content: <Command>powershell.exe</Command>
Subject: CORP\admin.ops

Frequently Asked Questions

What does Windows Event ID 4702 mean?

Event ID 4702 records that a scheduled task was updated and includes the actor, task name, and task definition content.

Which parts of TaskContent should be compared?

Compare actions and arguments, principals, run level, triggers, working directory, and settings with the prior XML or approved task baseline.

Does PowerShell in a scheduled task prove persistence?

No. Legitimate automation uses PowerShell; investigate unexpected changes, encoded or remote content, user-writable paths, elevated principals, and subsequent executions.

Sources