Suspicious Scheduled Task Creation with Scripting Languages

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•1

This rule detects the creation or modification of scheduled tasks (EventID 4698 or 4699) where the command line for the task contains references to scripting languages like PowerShell, cmd, or VBScript. It then groups these events by computer and user, flagging if two or more such tasks are created by the same user on the same computer, which could indicate malicious activity.