Lesson 146 — The Suspicious Process Created a Scheduled Task

Case briefing

Stage 1 — find scheduled-task creation activity

Begin with the known device and narrow investigation window. Search for common task-management executables and command-line patterns that may indicate task creation.

let TargetDevice = "WS-FIN-042";
let TargetTime = datetime(2026-08-18 01:22:24);
DeviceProcessEvents
| where DeviceName =~ TargetDevice
| where Timestamp between (TargetTime - 5m .. TargetTime + 10m)
| where FileName in~ ("schtasks.exe", "powershell.exe", "cmd.exe")
    or ProcessCommandLine has_any ("schtasks", "Register-ScheduledTask", "New-ScheduledTask")
| project Timestamp,
          AccountName,
          FileName,
          ProcessCommandLine,
          ProcessId,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          InitiatingProcessId
| order by Timestamp asc

Stage 2 — extract the task clue

Once task-creation activity is found, preserve the complete command line and extract useful identifiers such as the task name where the syntax allows it. The original command line remains the primary evidence.

let TargetDevice = "WS-FIN-042";
let TargetTime = datetime(2026-08-18 01:22:24);
DeviceProcessEvents
| where DeviceName =~ TargetDevice
| where Timestamp between (TargetTime - 5m .. TargetTime + 10m)
| where ProcessCommandLine has_any ("/create", "Register-ScheduledTask", "New-ScheduledTask")
| extend TaskName = extract(@"(?i)/tn\s+[""']?([^""']+)", 1, ProcessCommandLine)
| project Timestamp,
          AccountName,
          FileName,
          TaskName,
          ProcessCommandLine,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine
| order by Timestamp asc

Stage 3 — reconstruct activity around task creation

Expand the window slightly and place task-related processes alongside interpreters and utilities already present in the case. This helps show whether persistence was one step in the same execution chain.

let TargetDevice = "WS-FIN-042";
let TargetTime = datetime(2026-08-18 01:22:24);
DeviceProcessEvents
| where DeviceName =~ TargetDevice
| where Timestamp between (TargetTime - 10m .. TargetTime + 20m)
| where FileName in~ ("schtasks.exe", "taskeng.exe", "taskhostw.exe", "powershell.exe", "cmd.exe", "rundll32.exe")
| project Timestamp,
          FileName,
          ProcessCommandLine,
          ProcessId,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          InitiatingProcessId,
          AccountName
| order by Timestamp asc

Stage 4 — hunt the task pattern across the estate

Treat a distinctive task name or command fragment as another investigative pivot. Search across devices to determine whether the persistence pattern is isolated or repeated.

let SuspiciousTaskTerm = "UpdateCheck";
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine contains SuspiciousTaskTerm
| summarize FirstSeen=min(Timestamp),
            LastSeen=max(Timestamp),
            Executions=count(),
            Devices=dcount(DeviceId),
            DeviceNames=make_set(DeviceName, 50),
            Accounts=make_set(AccountName, 50),
            Commands=make_set(ProcessCommandLine, 25)
          by FileName
| order by FirstSeen asc

Stage 5 — build the persistence timeline

Finish by placing the relevant task and execution activity into chronological order. The goal is to show exactly where persistence appears in the wider endpoint compromise story.

let TargetDevice = "WS-FIN-042";
let StartTime = datetime(2026-08-18 01:22:00);
let EndTime = datetime(2026-08-18 01:40:00);
DeviceProcessEvents
| where DeviceName =~ TargetDevice
| where Timestamp between (StartTime .. EndTime)
| where FileName in~ ("schtasks.exe", "taskeng.exe", "taskhostw.exe",
                       "powershell.exe", "cmd.exe", "rundll32.exe")
    or ProcessCommandLine has_any ("UpdateCheck", "Register-ScheduledTask")
| project Timestamp,
          AccountName,
          InitiatingProcessFileName,
          FileName,
          ProcessCommandLine,
          ProcessId,
          InitiatingProcessId
| order by Timestamp asc

Agent Foskett's persistence timeline

Your evidence board

Write the finding like an investigator

Example: Microsoft Defender XDR process telemetry on WS-FIN-042 recorded scheduled-task creation activity shortly after the suspicious process, file and network events identified earlier in the investigation. The task-creation command was preserved together with the initiating-process ancestry, account and timestamp. The task action referenced activity associated with the suspicious execution chain, supporting the hypothesis that the task was created to establish persistence. The task name and command pattern were then hunted across the environment to determine whether similar persistence existed on other devices. The scheduled task should be assessed and remediated as part of the wider endpoint incident rather than treated as an isolated configuration event.

Lesson 146 key takeaways

• Scheduled tasks are legitimate Windows mechanisms that can also be used for persistence.
• Search process telemetry for task-management executables and task-creation command patterns.
• Preserve the full command line rather than relying only on an extracted task name.
• Use initiating-process ancestry to connect task creation to earlier suspicious execution.
• Account and timestamp context can materially change the interpretation.
• A harmless-looking task name proves very little by itself.
• The task action — what it will execute — is often the more important clue.
• Hunt distinctive task names and command fragments across the estate.
• Repeated tasks can represent either coordinated persistence or legitimate deployment.
• Confirmed persistence means remediation must address more than the original process.

Module 12 — the attack chain continues

Lesson 145 followed the suspicious process into outbound network activity. Lesson 146 now shows evidence consistent with persistence through a scheduled task. Next we examine another common persistence clue: a registry run key that appeared after compromise.