Scheduled Task Creation with System or Admin in Command Line

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•3

This rule detects the creation of scheduled tasks (Event ID 4697) where the command line contains either 'System' or 'Admin'. This could indicate an attempt to create a scheduled task that runs with elevated privileges or impersonates system/admin accounts for persistence or privilege escalation.