Detection rules › Splunk
Randomly Generated Scheduled Task Name
The following analytic detects the creation of a Scheduled Task with a high entropy, randomly generated name, leveraging Event ID 4698. It uses the ut_shannon function from the URL ToolBox Splunk application to measure the entropy of the Task Name. This activity is significant as adversaries often use randomly named Scheduled Tasks for lateral movement and remote code execution, employing tools like Impacket or CrackMapExec. If confirmed malicious, this could allow attackers to execute arbitrary code remotely, potentially leading to further compromise and persistence within the network.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1053.005 Scheduled Task/Job: Scheduled Task |
| Persistence | T1053.005 Scheduled Task/Job: Scheduled Task |
| Privilege Escalation | T1053.005 Scheduled Task/Job: Scheduled Task |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4698 | A scheduled task was created. |
Rule body splunk
name: Randomly Generated Scheduled Task Name
id: 9d22a780-5165-11ec-ad4f-3e22fbd008af
version: 10
creation_date: '2021-11-30'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: experimental
type: Hunting
description: The following analytic detects the creation of a Scheduled Task with a high entropy, randomly generated name, leveraging Event ID 4698. It uses the `ut_shannon` function from the URL ToolBox Splunk application to measure the entropy of the Task Name. This activity is significant as adversaries often use randomly named Scheduled Tasks for lateral movement and remote code execution, employing tools like Impacket or CrackMapExec. If confirmed malicious, this could allow attackers to execute arbitrary code remotely, potentially leading to further compromise and persistence within the network.
data_source:
- Windows Event Log Security 4698
search: |-
`wineventlog_security` EventCode=4698
| xmlkv Message
| lookup ut_shannon_lookup word as Task_Name
| where ut_shannon > 3
| table _time, dest, Task_Name, ut_shannon, Command, Author, Enabled, Hidden
| `randomly_generated_scheduled_task_name_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA as well as the URL ToolBox application are also required.
known_false_positives: Legitimate applications may use random Scheduled Task names.
references:
- https://attack.mitre.org/techniques/T1053/005/
- https://splunkbase.splunk.com/app/2734/
- https://en.wikipedia.org/wiki/Entropy_(information_theory)
analytic_story:
- Active Directory Lateral Movement
- CISA AA22-257A
- Scheduled Tasks
- 0bj3ctivity Stealer
asset_type: Endpoint
mitre_attack_id:
- T1053.005
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
category: endpoint
security_domain: endpoint
Stages and Predicates
Stage 1: search
`wineventlog_security` EventCode=4698
Stage 2: xmlkv
| xmlkv Message
Stage 3: lookup
| lookup ut_shannon_lookup word as Task_Name
Stage 4: where
| where ut_shannon > 3
Stage 5: table
| table _time, dest, Task_Name, ut_shannon, Command, Author, Enabled, Hidden
Stage 6: search
| `randomly_generated_scheduled_task_name_filter`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
ut_shannon | gt |
|