Skip to main content
AD Academy
Back to all events
4698SecuritySecurity & attacksWARNLast updated:

Scheduled task created

What it means

Scheduled tasks are a popular persistence trick: they survive reboots and look harmless.

First steps

  1. 1Read the XML in the event: what runs and under which account.
  2. 2A SYSTEM task running encoded PowerShell needs investigation.

Related events

This reference is a starting point for investigation, not a replacement for your organisation's security policy.