Remote Scheduled Task Creation/Modification on DCs (4698/4702)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•1

Detects the creation or modification of Windows scheduled tasks using Security Event IDs 4698 and 4702. This rule parses the event data to extract key task information such as task name, command, arguments, and the author of the task.