Payouts King Suspicious Scheduled Task Creation via schtasks or Event ID 4698

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the creation of suspicious scheduled tasks by monitoring Windows Event Logs (EventCode 4698) for task XML content and process creation events (EventCode 1) for the 'schtasks.exe' utility. The rule identifies tasks created in user-writable paths (like AppData or Temp), tasks containing suspicious keywords like 'hidden' or specific Mozilla update patterns, tasks configured to run as SYSTEM, and tasks spawned by non-standard parent processes.