Schedule Task with Rundll32 Command Trigger

name: Schedule Task with Rundll32 Command Trigger
id: 75b00fd8-a0ff-11eb-8b31-acde48001122
version: 12
creation_date: '2021-04-26'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the creation of scheduled tasks in Windows that use the rundll32 command. It leverages Windows Security EventCode 4698, which logs the creation of scheduled tasks, and filters for tasks executed via rundll32. This activity is significant as it is a common technique used by malware, such as TrickBot, to persist in an environment or deliver additional payloads. If confirmed malicious, this could lead to data theft, ransomware deployment, or other damaging outcomes. Immediate investigation and mitigation are crucial to prevent further compromise.
data_source:
    - Windows Event Log Security 4698
search: |-
    `wineventlog_security` EventCode=4698
      | xmlkv Message
      | search Command IN ("*rundll32*")
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest, Task_Name, Command,
           Author, Enabled, Hidden,
           Arguments
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `schedule_task_with_rundll32_command_trigger_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment.
known_false_positives: No false positives have been identified at this time.
references:
    - https://labs.vipre.com/trickbot-and-its-modules/
    - https://whitehat.eu/incident-response-case-study-featuring-ryuk-and-trickbot-part-2/
finding:
    title: A scheduled task process commandline rundll32 arguments $Arguments$ on host $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Persistence Techniques
    - Living Off The Land
    - IcedID
    - Scheduled Tasks
    - Compromised Windows Host
    - Trickbot
    - Castle RAT
asset_type: Endpoint
mitre_attack_id:
    - T1053
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint