Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Detecting Malicious Scheduled Tasks with Sysmon · mukul975 | DecimalAI

Detecting Malicious Scheduled Tasks With Sysmon

SkillScore5Maintained

detecting-malicious-scheduled-tasks-with-sysmon

Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), and Windows Security Event 4698/4702. The analyst correlates task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement via scheduled tasks. Activates for requests involving scheduled task detection, Sysmon persistence hunting, or T1053.005 Scheduled Task/Job analysis.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/detecting-malicious-scheduled-tasks-with-sysmon/SKILL.md

decimalai skills pull detecting-malicious-scheduled-tasks-with-sysmon --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/detecting-malicious-scheduled-tasks-with-sysmon/SKILL.md https://app.decimal.ai/s/detecting-malicious-scheduled-tasks-with-sysmon/SKILL.md

Raw file: /s/detecting-malicious-scheduled-tasks-with-sysmon/SKILL.md ↗ · machine-readable summary at /s/detecting-malicious-scheduled-tasks-with-sysmon.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 56d ago

Yes — +5% lift+18% tokens0% turns5% of whole cases pass with skill (1/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-19	✗→✓	▲ Improved	—	—
case-22	✗→✗	＝ Same ✗	—	—
case-06	✗→✗	＝ Same ✗	—	—
case-07	✗→✗	＝ Same ✗	—	—
case-05	✗→✗	＝ Same ✗	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/detecting-malicious-scheduled-tasks-with-sysmon/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/1/2026Version v1Bundled 2 files · scripts

Skill contents

scripts/

references/

SKILL.md

Detecting Malicious Scheduled Tasks with Sysmon

Overview

Adversaries abuse Windows Task Scheduler (schtasks.exe, at.exe) for persistence (T1053.005) and lateral movement. Sysmon Event ID 1 captures schtasks.exe process creation with full command-line arguments, while Event ID 11 captures task XML files written to C:\Windows\System32\Tasks\. Windows Security Event 4698 logs task registration details. This skill covers building detection rules that correlate these events to identify malicious scheduled tasks created from suspicious paths, with encoded payloads, or targeting remote systems.

When to Use

When investigating security incidents that require detecting malicious scheduled tasks with sysmon
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Sysmon installed with a detection-focused configuration (e.g., SwiftOnSecurity or Olaf Hartong)
Windows Event Log forwarding to SIEM (Splunk, Elastic, or Sentinel)
PowerShell ScriptBlock Logging enabled (Event 4104)

Steps

Configure Sysmon to log Event IDs 1, 11, 12, 13 with task-related filters
Build detection rules for schtasks.exe /create with suspicious arguments
Correlate Event 4698 (task registered) with Sysmon Event 1 (process create)
Hunt for tasks executing from public directories or with encoded commands
Alert on remote task creation (schtasks /s) for lateral movement detection

Expected Output

[CRITICAL] Suspicious Scheduled Task Detected
  Task: \Microsoft\Windows\UpdateCheck
  Command: powershell.exe -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGU...
  Created By: DOMAIN\compromised_user
  Parent Process: cmd.exe (PID 4532)
  Source: \\192.168.1.50 (remote creation)
  MITRE: T1053.005 - Scheduled Task/Job

Illustrative Want to see what detecting-malicious-scheduled-tasks-with-sysmon would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 01:45 UTC · 22 cases

Lift

+5%

5% vs 0%

Agent turns

1.0 vs 1.0

Tokens

+18%

1,212.77 vs 1,030.09

fail → pass · 1fail → fail · 21

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-22 A incident responder is analyzing a Windows RAM image using Volatility 3 to locate unbacked memory pages indicative of process injection. Which plugin module should be run?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 Which Windows Event Log ID records decoded script block contents when PowerShell executes code initiated by a task?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 Which specific MITRE ATT&CK sub-technique ID should be assigned to alerts triggered by malicious scheduled task creation on Windows?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 Which Sysmon Event ID captures process execution events along with full command line arguments when schtasks.exe runs?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 If schtasks.exe with the /create argument is spawned by IIS w3wp.exe or Tomcat java.exe processes, what primary threat vector does this pattern indicate?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 To mitigate AS-REP roasting risks in Active Directory, an administrator needs to ensure Kerberos Pre-Authentication is required for user accounts. Which account control property should be configured?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 Which command-line argument causes schtasks.exe to execute an existing scheduled task immediately rather than waiting for its trigger time?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 An alert fires showing schtasks.exe creating a task on a remote machine (/s) running an encoded PowerShell command (-enc). What triage severity level should be assigned to this finding?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-01 When creating a Sysmon Event ID 11 (File Create) rule to capture scheduled task definitions written to disk, which specific system directory path should be monitored?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 Which legacy Windows command-line utility for scheduling jobs should be included alongside schtasks.exe in process creation detection rules?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 A SOC team wants to correlate process creation events with Windows Security log events. Which Event ID specifically records detailed task registration info including full task XML parameters?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 An attacker uses schtasks.exe to remotely create a scheduled task on another machine during lateral movement. Which command-line parameter flag specifies the target remote host system?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 When auditing command-line parameters for scheduled tasks executing obfuscated PowerShell code, which command argument flag indicates a base64 encoded command string?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 When configuring Sysmon to track registry modifications associated with scheduled task configuration changes, which Event ID tracks registry key/value creation and modifications?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 Which Sysmon Event ID tracks registry value set operations when task parameters are modified directly in the registry?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 Which Sysmon Event ID triggers when a new scheduled task XML definition file is generated in the system tasks directory?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 Threat actors frequently drop binaries into world-writable staging paths before scheduling them. Which common Windows directory path represents a public staging location for malicious task payloads?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 When linking Windows Security Event 4698 to a Sysmon Event 1 process creation event, which field value serves as the primary identifier connecting the process execution to the user session?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 In Windows Security Event 4698 XML data, under which XML element node is the exact command or executable path defined?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 An adversary attempts to clean up traces by removing a scheduled task immediately after execution. Which flag parameter passed to schtasks.exe signals task deletion?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 When analyzing a task creation event for privilege escalation, which RunLevel setting value inside the task principal configuration indicates execution with elevated administrative rights?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 A Linux administrator needs to audit changes to scheduled cron jobs in /etc/cron.d/ to catch persistence attempts. How should Auditd rules be configured on Linux?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +5 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 0%
Pass rate with the skill: 4.6%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 01:45 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run5

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.