Rapid scheduled task create-then-delete (4698/4699)

Ankit Mehta@Secvyn

•updated Aug 28, 2026•2•0•5

Detects instances where a Windows Scheduled Task is created (Event ID 4698) and subsequently deleted (Event ID 4699) within a very short timeframe (less than 120 seconds). This behavior is often indicative of an adversary creating a temporary task for execution and immediately cleaning up evidence to avoid detection.