Detection rules › Splunk
Schedule Task with HTTP Command Arguments
The following analytic detects the creation of scheduled tasks on Windows systems that include HTTP command arguments, using Windows Security EventCode 4698. It identifies tasks registered via schtasks.exe or TaskService with HTTP in their command arguments. This behavior is significant as it often indicates malware activity or the use of Living off the Land binaries (lolbins) to download additional payloads. If confirmed malicious, this activity could lead to data exfiltration, malware propagation, or unauthorized access to sensitive information, necessitating immediate investigation and mitigation.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1053 Scheduled Task/Job |
| Persistence | T1053 Scheduled Task/Job |
| Privilege Escalation | T1053 Scheduled Task/Job |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4698 | A scheduled task was created. |
Rule body splunk
name: Schedule Task with HTTP Command Arguments
id: 523c2684-a101-11eb-916b-acde48001122
version: 12
creation_date: '2021-04-26'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the creation of scheduled tasks on Windows systems that include HTTP command arguments, using Windows Security EventCode 4698. It identifies tasks registered via schtasks.exe or TaskService with HTTP in their command arguments. This behavior is significant as it often indicates malware activity or the use of Living off the Land binaries (lolbins) to download additional payloads. If confirmed malicious, this activity could lead to data exfiltration, malware propagation, or unauthorized access to sensitive information, necessitating immediate investigation and mitigation.
data_source:
- Windows Event Log Security 4698
search: |-
`wineventlog_security` EventCode=4698
| xmlkv Message
| search Arguments IN ("*http*")
| stats count min(_time) as firstTime max(_time) as lastTime
BY dest, Task_Name, Command,
Author, Enabled, Hidden,
Arguments
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `schedule_task_with_http_command_arguments_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment.
known_false_positives: No false positives have been identified at this time.
references:
- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: 7d
latest_offset: "0"
finding:
title: A scheduled task process commandline arguments $Arguments$ with http string in it on host $dest$
entity:
field: dest
type: system
score: 50
analytic_story:
- Windows Persistence Techniques
- Living Off The Land
- Compromised Windows Host
- Scheduled Tasks
- Winter Vivern
- Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
- T1053
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/tasksched/windows-security.log
source: WinEventLog:Security
sourcetype: WinEventLog
test_type: unit
Stages and Predicates
Stage 1: search
`wineventlog_security` EventCode=4698
Stage 2: xmlkv
| xmlkv Message
Stage 3: search
| search Arguments IN ("*http*")
Stage 4: stats
| stats count min(_time) as firstTime max(_time) as lastTime
BY dest, Task_Name, Command,
Author, Enabled, Hidden,
Arguments
Stage 5: search
| `security_content_ctime(firstTime)`
Stage 6: search
| `security_content_ctime(lastTime)`
Stage 7: search
| `schedule_task_with_http_command_arguments_filter`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.