Detecting Malicious Scheduled Tasks
FreeIdentify and analyze malicious tasks in Windows systems.
Free · Opens the source repo
What Detecting Malicious Scheduled Tasks does
This skill aids security analysts in detecting malicious scheduled tasks on Windows systems by leveraging Sysmon event logs. It specifically focuses on Event IDs that capture the creation and modification of scheduled tasks, which adversaries often exploit for persistence and lateral movement. By correlating these events, analysts can identify potentially harmful tasks created from suspicious parent processes or public directory paths. This skill is essential for threat hunting and building detection rules that enhance security monitoring capabilities.
The skill operates by utilizing Sysmon Event ID 1, which logs the creation of processes like schtasks.exe, and Event ID 11, which captures the creation of task XML files. Additionally, Windows Security Event 4698 provides details about task registration. By analyzing these logs, analysts can build detection rules that highlight tasks with encoded command arguments or those targeting remote systems, thus improving their ability to detect and respond to threats.
Ideal for security operations center (SOC) teams, this skill provides structured procedures for investigating incidents involving scheduled tasks. It is particularly useful when validating security monitoring coverage for attack techniques associated with scheduled tasks, such as T1053.005. By implementing this skill, organizations can enhance their threat detection capabilities and reduce the risk of adversaries leveraging scheduled tasks for malicious purposes.
When to use it
Use this skill when investigating security incidents related to scheduled tasks or when developing detection rules for threat hunting.
When not to use it
This skill may not be suitable for environments without Sysmon installed or where Windows Event Logs are not being forwarded to a SIEM.
What you can build with it
Incident Investigation
Use this skill during security incidents to quickly identify any malicious scheduled tasks that may have been created by attackers.
Building Detection Rules
Leverage this skill to develop detection rules that monitor for suspicious task creation and modifications in your environment.
Threat Hunting Queries
Employ this skill to create threat hunting queries that focus on scheduled task analysis and correlate with Sysmon events.
How to install Detecting Malicious Scheduled Tasks
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/detecting-malicious-scheduled-tasks-with-sysmon --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Detecting Malicious Scheduled Tasks with Sysmon
Overview
Adversaries abuse Windows Task Scheduler (schtasks.exe, at.exe) for persistence (T1053.005) and lateral movement. Sysmon Event ID 1 captures schtasks.exe process creation with full command-line arguments, while Event ID 11 captures task XML files written to C:\Windows\System32\Tasks. Windows Security Event 4698 logs task registration details. This skill covers building detection rules that correlate these events to identify malicious scheduled tasks created from suspicious paths, with encoded payloads, or targeting remote systems.
When to Use
- When investigating security incidents that require detecting malicious scheduled tasks with sysmon
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Sysmon installed with a detection-focused configuration (e.g., SwiftOnSecurity or Olaf Hartong)
- Windows Event Log forwarding to SIEM (Splunk, Elastic, or Sentinel)
- PowerShell ScriptBlock Logging enabled (Event 4104)
Steps
- Configure Sysmon to log Event IDs 1, 11, 12, 13 with task-related filters
- Build detection rules for schtasks.exe /create with suspicious arguments
- Correlate Event 4698 (task registered) with Sysmon Event 1 (process create)
- Hunt for tasks executing from public directories or with encoded commands
- Alert on remote task creation (schtasks /s) for lateral movement detection
Expected Output
[CRITICAL] Suspicious Scheduled Task Detected
Task: \Microsoft\Windows\UpdateCheck
Command: powershell.exe -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGU...
Created By: DOMAIN\compromised_user
Parent Process: cmd.exe (PID 4532)
Source: \\192.168.1.50 (remote creation)
MITRE: T1053.005 - Scheduled Task/Job
Frequently asked questions about Detecting Malicious Scheduled Tasks
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.