Remote Scheduled Task Created with Mismatched InteractiveToken UserId (4698)

Ankit Mehta@Secvyn

•updated Aug 28, 2026•3•1•2

Detects the creation of a Windows Scheduled Task (Event ID 4698) that uses the 'InteractiveToken' LogonType, where the user specified to execute the task is different from the user who registered the task. This behavior is indicative of potential session hijacking or lateral movement techniques, such as those used by tools like 'atexec' or to facilitate PRT (Primary Refresh Token) theft.