Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Hunting for Suspicious Scheduled Tasks · mukul975 | DecimalAI

Hunting For Suspicious Scheduled Tasks

SkillScore27Maintained

hunting-for-suspicious-scheduled-tasks

Hunt for adversary persistence and execution via Windows scheduled tasks by analyzing task creation events, suspicious task properties, and unusual execution patterns that indicate T1053.005 abuse.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/hunting-for-suspicious-scheduled-tasks/SKILL.md

decimalai skills pull hunting-for-suspicious-scheduled-tasks --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/hunting-for-suspicious-scheduled-tasks/SKILL.md https://app.decimal.ai/s/hunting-for-suspicious-scheduled-tasks/SKILL.md

Raw file: /s/hunting-for-suspicious-scheduled-tasks/SKILL.md ↗ · machine-readable summary at /s/hunting-for-suspicious-scheduled-tasks.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

Yes — +27% lift+24% tokens0% turns27% of whole cases pass with skill (6/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-19	✗→✓	▲ Improved	—	—
case-02	✗→✓	▲ Improved	—	—
case-01	✗→✓	▲ Improved	—	—
case-12	✗→✓	▲ Improved	—	—
case-03	✗→✓	▲ Improved	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/hunting-for-suspicious-scheduled-tasks/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 6 files · scripts

Skill contents

scripts/

references/

assets/

SKILL.md

Hunting for Suspicious Scheduled Tasks

When to Use

When proactively hunting for persistence mechanisms in Windows environments
After detecting schtasks.exe or at.exe usage in process creation logs
When investigating malware that survives reboots and user logoffs
During incident response to enumerate all persistence on compromised systems
When Windows Security Event ID 4698 (Scheduled Task Created) fires for unusual tasks

Prerequisites

Windows Security Event ID 4698/4699/4702 (Task Created/Deleted/Updated)
Sysmon Event ID 1 for schtasks.exe process creation with command lines
Windows Task Scheduler operational log (Microsoft-Windows-TaskScheduler/Operational)
PowerShell logging for Register-ScheduledTask cmdlet usage
Access to Task Scheduler XML definitions on endpoints

Workflow

Enumerate All Scheduled Tasks: Collect complete task inventory from target systems using schtasks /query /fo CSV /v or Get-ScheduledTask PowerShell cmdlet.
Monitor Task Creation Events: Track Event ID 4698 for new task creation, correlating with the creating process and user account context.
Analyze Task Actions: Examine what each task executes. Flag tasks running scripts (PowerShell, cmd, wscript), binaries from user-writable paths (TEMP, AppData, Downloads), or encoded/obfuscated commands.
Check Task Triggers: Review trigger conditions. Tasks triggered by system startup, user logon, or short intervals (1-5 minutes) warrant investigation.
Identify Hidden or Disguised Tasks: Hunt for tasks with names mimicking legitimate Windows tasks, tasks with Security Descriptor modifications hiding them from standard enumeration, or tasks stored in non-standard registry locations.
Correlate with Process Execution: Match scheduled task execution events with process creation logs to confirm what actually runs.
Baseline and Diff: Compare current task inventory against known-good baselines to identify new, modified, or unexpected tasks.

Detection Queries

Splunk -- Scheduled Task Creation

spl
index=wineventlog EventCode=4698
| spath output=TaskName path=EventData.TaskName
| spath output=TaskContent path=EventData.TaskContent
| where NOT match(TaskName, "(?i)(\\\\Microsoft\\\\|\\\\Windows\\\\)")
| table _time Computer SubjectUserName TaskName TaskContent

Splunk -- Schtasks.exe Suspicious Usage

spl
index=sysmon EventCode=1 Image="*\\schtasks.exe"
| where match(CommandLine, "(?i)/create")
| where match(CommandLine, "(?i)(powershell|cmd|wscript|cscript|mshta|rundll32|regsvr32|http|https|\\\\temp\\\\|\\\\appdata\\\\)")
| table _time Computer User CommandLine ParentImage

KQL -- Microsoft Sentinel

kql
SecurityEvent
| where EventID == 4698
| extend TaskName = tostring(EventData.TaskName)
| extend TaskContent = tostring(EventData.TaskContent)
| where TaskContent has_any ("powershell", "cmd.exe", "wscript", "http://", "https://", "\\Temp\\", "\\AppData\\")
| project TimeGenerated, Computer, Account, TaskName, TaskContent

Common Scenarios

Cobalt Strike Persistence: Creates scheduled tasks via schtasks.exe to execute PowerShell download cradles at user logon intervals.
Ransomware Staging: Task created to run encryption payload at a future time, often during off-hours for maximum impact.
Hidden Task via SD Modification: Attacker modifies Security Descriptor of scheduled task to hide it from normal enumeration while maintaining execution.
COM Handler Abuse: Task uses COM handler rather than direct executable path, making action inspection more complex.
Lateral Movement via Tasks: Remote scheduled task creation using schtasks /create /s REMOTE_HOST for execution on other systems.

Output Format

Hunt ID: TH-SCHTASK-[DATE]-[SEQ]
Host: [Hostname]
Task Name: [Full task path]
Action: [Command/Script executed]
Trigger: [Startup/Logon/Timer/Event]
Created By: [User account]
Created From: [Local/Remote]
Creation Time: [Timestamp]
Run As: [Execution account]
Risk Level: [Critical/High/Medium/Low]

Illustrative Want to see what hunting-for-suspicious-scheduled-tasks would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 08:32 UTC · 22 cases

Lift

+27%

27% vs 0%

Agent turns

1.0 vs 1.0

Tokens

+24%

2,670.14 vs 2,147.18

fail → pass · 6fail → fail · 16

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-13 During task analysis, an analyst noticed a scheduled task executing a script located in C:\Users\Public\AppData\Local\Temp\update.vbs. Why is an action executing from user-writable directories prioritized for high-risk triage in scheduled task hunting?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 When monitoring PowerShell activity for scheduled task manipulation, which specific PowerShell cmdlet usage should be audited in Script Block / Module logging?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 When searching Windows Security event logs for scheduled task creation events, analysts often query Event ID 4688 for general process creation. What specific Windows Security Event ID signals that a scheduled task object was explicitly created?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 To track the lifecycle of scheduled tasks in Windows Security logs beyond initial creation, what specific Windows Security Event IDs represent task deletion and task update operations?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 During an endpoint investigation, we suspect WMI Event Subscriptions were registered for persistence. Provide the detection methods and WMI classes to inspect for malicious event consumers and bindings.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 When evaluating scheduled task trigger configurations during a threat hunt, which specific trigger conditions and interval patterns represent high risk for immediate persistence or frequent beaconing?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 A ransomware staging task was created on host BACKUP-01 to launch an encryption payload at 02:00 AM off-hours. Format the threat hunt report for this finding using the standard key-value output schema.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-02 Our SIEM caught a remote scheduled task creation command targeting server FS-PROD-01 from a domain controller. I need you to investigate potential lateral movement or persistence using task scheduler logs. Summarize your triage output clearly listing the identifier, host involved, full task name/path, executed command, trigger mechanism, creator account, remote/local source, creation timestamp, privilege context it runs under, and assigned severity level.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We recently flagged an alert for a suspicious job creation on workstation HR-LAPTOP-04. The SOC detected a process launching a script from an AppData subfolder right after logon. Please perform a persistence hunt on this machine to analyze any suspicious job definitions. Format your finding as a structured hunt report containing the Hunt ID, Host, Task Name, Action, Trigger, Created By, Created From, Creation Time, Run As, and Risk Level.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-12 We are writing a KQL query in Microsoft Sentinel over SecurityEvent logs to detect suspicious scheduled task creations (EventID 4698). How should we construct the KQL query to parse TaskName and TaskContent from EventData and filter for suspicious execution engines or paths?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-20 Which specific Windows Event log channel provides operational execution history for scheduled tasks when correlating task execution with Sysmon process creation events?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 A SOC analyst spotted command-line activity where schtasks.exe /create included the flag /s DB-SERVER-01. What attack scenario does this command represent, and what does the /s flag signify in this context?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 An incident handler is reviewing an alert for schtasks.exe creation commands. What Sysmon Event ID records process creation with complete command lines to perform this correlation?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 During an incident response investigation on ENDPOINT-882, we noticed a persistent mechanism running encoded commands at startup. Please analyze the endpoint's task configurations and creation events. Present your findings using the standard threat hunt schema: Hunt ID, target host, task path, executed action, trigger type, creator user, origin (local/remote), timestamp of creation, run-as execution account, and overall risk rating.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-15 An attacker modified the Security Descriptor of a scheduled task to make it invisible to standard GUI enumeration while the task remains active. How does a threat hunter detect or investigate tasks obscured via Security Descriptor modifications?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 We detected Cobalt Strike persistence on host WEBSERVER-01 where a scheduled task ran a PowerShell download cradle at logon. Format the threat hunt report for this finding following the standard threat hunt output schema.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-10 We want to write a Splunk query targeting Windows Security log Event Code 4698 to detect suspicious task creations. Most default Windows tasks generate false positives. How should the query filter out default Microsoft and Windows task paths using regex matching on TaskName?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 We want a Splunk search using Sysmon process creation (EventCode 1) to identify suspicious execution of schtasks.exe. Analysts want to catch creation commands that launch scripting engines or binaries from temporary paths. What Splunk query structure filters for schtasks.exe /create commands executing engines like PowerShell, CMD, or AppData/Temp paths?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 I need to dump the complete scheduled task inventory from Windows endpoint WIN-SERV-02 using command-line tools to find hidden or detailed task parameters. Junior analysts suggested running `schtasks` with no arguments, but that gives truncated output. What exact CLI command string provides full verbose details in structured CSV format?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 An analyst inspecting task XML definitions noticed that instead of an Exec element with a binary path, the task contains a COMHandler section with a CLSID. How does COM handler usage affect task inspection, and how should hunters analyze it?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 An adversary was observed maintaining persistence on host SEC-02 via Registry Run keys under HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE. Provide a triage process and registry location checklist to identify these run key modifications.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 We are auditing persistence on workstation FIN-01 and want to analyze Windows Service installations created on the host. Please construct an event log query and triage steps for newly installed system services.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +27 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 0%
Pass rate with the skill: 27.3%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 08:32 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run27

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.