splApache-2.0from splunk/security_content

Windows Hidden Schedule Task Settings

The following analytic detects the creation of hidden scheduled tasks on Windows systems, which are not visible in the UI. It leverages Windows Security EventCode 4698 to identify tasks where the 'Hidden' setting is enabled. This behavior is significant as it may indicate malware activity, such as Industroyer2, or the use of living-off-the-land binaries (LOLBINs) to download additional payloads. If confirmed malicious, this activity could allow attackers to execute code stealthily, maintain persistence, or further compromise the system by downloading additional malicious payloads.

Quality

FP risk

—

Forks

Views

Rule sourcedetections/endpoint/windows_hidden_schedule_task_settings.yml

`wineventlog_security`
EventCode=4698
TaskContent = "*&lt;Hidden&gt;true&lt;/Hidden&gt;*"
| stats count min(_time) as firstTime max(_time) as lastTime
  by TaskName TaskContent action signature status dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_hidden_schedule_task_settings_filter`