SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
hunting-scheduled-task-abuse
0
Hunts for malicious scheduled task persistence by analyzing task registration events (4698) and schtasks process creation for suspicious actions, triggers, and hidden tasks. Activates for requests to hunt scheduled task abuse, detect malicious schtasks usage, or find persistence via the Task Scheduler.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Hunting Scheduled Task Abuse ## When to Use - You have task-registration events (4698) and/or `schtasks.exe`/`at.exe` process telemetry and want to detect persistence via malicious scheduled tasks. - You are investigating tasks that run scripts, encoded commands, or binaries from suspicious paths. **Do not use** this to alert on all task creation — administration creates tasks routinely. Hunt on the action (script hosts, encoded commands, temp paths) and trigger context. ## Prerequisites - Event ID 4698 (task registered) and/or process-creation telemetry for `schtasks`/`at`. ## Workflow ### Step 1: Hunt suspicious task actions ```bash python scripts/analyst.py hunt events.csv ``` Flags tasks whose action runs `powershell -enc`, `mshta`, `wscript`/`cscript`, `cmd /c`, or binaries from `%TEMP%`/`%APPDATA%`/`Public`, and `schtasks /create` command lines with the same. ### Step 2: Assess triggers and hiding Note logon/onstart triggers, very frequent intervals, and tasks hidden via `Hidden` flag or SD manipulation. ### Step 3: Confirm Distinguish legitimate software tasks from intrusion by author, path, and action content. ### Step 4: Operationalize Write a Sigma rule for task actions invoking script hosts or encoded commands. ## Validation - Flags require a suspicious action/path, not task creation alone. - `schtasks /create` and 4698 registrations are both covered. - Findings map to ATT&CK T1053.005. ## Pitfalls - Legitimate updater tasks (browsers, vendors) creating many tasks. - Tasks created via direct XML drop bypassing `schtasks.exe` telemetry. - Encoded commands hiding the true action. ## References - See [`references/api-reference.md`](references/api-reference.md) for the hunter. - ATT&CK T1053.005 and Event 4698 docs (linked in frontmatter).