Hidden Scheduled Task Created - Windows (Windows Event Log)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

A hidden scheduled task in Windows is a task configured to run specified actions silently without displaying any visible program windows or interfaces to the user. Threat actors may abuse this feature to persistently execute malicious activities covertly, avoiding detection while maintaining a presence on the victim's system, as observed in breaches involving Industroyer2. This use case detects scheduled task creation events where the 'Hidden' setting is enabled.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1053` Scheduled Task/Job
Persistence	`T1053` Scheduled Task/Job
Privilege Escalation	`T1053` Scheduled Task/Job

References

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4698: A scheduled task was created.

Rule body

id: '30937.55362'
title: Hidden Scheduled Task Created - Windows
description: A hidden scheduled task in Windows is a task configured to run specified
  actions silently without displaying any visible program windows or interfaces to
  the user. Threat actors may abuse this feature to persistently execute malicious
  activities covertly, avoiding detection while maintaining a presence on the victim's
  system, as observed in breaches involving Industroyer2. This use case detects scheduled
  task creation events where the 'Hidden' setting is enabled.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4698) OR
  "<EventID>4698<") "hidden" "true" | where match(TaskContent, "(?i)Hidden(>|>)true")
  | table _time, host, user, TaskName | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- execution:scheduled task/job
technique_id: 
- T1053
data_category:
- Windows event logs
references:
- https://research.splunk.com/endpoint/0b730470-5fe8-4b13-93a7-fe0ad014d0cc/
- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
- https://cert.gov.ua/article/39518

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4698) OR "<EventID>4698<") "hidden" "true"

Stage 2: `where`

| where match(TaskContent, "(?i)Hidden(>|>)true")

Stage 3: `table`

| table _time, host, user, TaskName

Stage 4: `bucket`

| bin span=1s

Stage 5: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`4698` corpus 13 (splunk 13)	`field:"EventID" kind:eq value:"4698"`
`TaskContent`	regex_match	`"(?i)Hidden(>\|>)true"`	`field:"TaskContent" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>4698<"`
1	`"hidden"`
1	`"true"`