KQL Search

Query Details

Scheduled Task Creation Details

MDE Scheduled Task Created

Query

DeviceEvents
| where ActionType == "ScheduledTaskCreated"
| extend AF = parse_json(AdditionalFields)
| extend TaskContent = parse_json(tostring(AF.TaskContent))
| extend
    TaskName = tostring(AF.TaskName),
    SubjectUserName = tostring(AF.SubjectUserName),
    TaskTriggers = TaskContent["Triggers"],
    TaskActions = TaskContent["Actions"]
| extend
    TaskTriggerType = strcat_array(bag_keys(TaskTriggers), ", "),
    TaskCommand = tostring(TaskActions["Exec"]["Command"]),
    TaskArguments = tostring(TaskActions["Exec"]["Arguments"])
| project
    Timestamp,
    DeviceName,
    SubjectUserName,
    TaskName,
    TaskTriggerType,
    TaskCommand,
    TaskArguments,
    TaskTriggers,
    TaskActions
| order by Timestamp desc

About this query

Explanation

This query is designed for threat hunting by identifying the creation of scheduled tasks on Windows devices using Microsoft Defender for Endpoint data. It focuses on events where a scheduled task is created, extracting key details such as the task name, the user who created it, the types of triggers, and the command and arguments used in the task's execution action. The query does not determine if the task is malicious or if it has been executed, but it helps in assessing potential risks by providing detailed information about the task's configuration. The results are sorted by the most recent events, and users can apply a time filter to narrow down the search period. The query is useful for detecting potential abuse of scheduled tasks for execution, persistence, or privilege escalation.