What is a scheduled-task event?¶

A scheduled-task event records activity connected with a task configured to run automatically at a set time or when a defined condition occurs.

Scheduled tasks can launch programs, scripts, updates, backups and maintenance jobs.

Avoid this assumption: That activity recorded under a user account at a particular time proves that the user was present and initiated it then. A scheduled task may run without any person being present.

The task may trigger at startup, login, a fixed time, a repeated interval or after another system event. It may run under a user, administrator, system or service account.

Logs can record task creation, modification, launch, completion, failure and the account used. These records can help explain why a process started or why network and file activity occurred.

But a launch event does not necessarily prove successful completion. A completed status may refer only to the scheduler handing control to a program. The program itself may fail later and record that elsewhere.

Investigators should identify the task name, trigger, action, account context and creation or modification history. Preserve the task definition, executable path, command-line arguments and linked process events.

Ask who could create or alter the task and whether it formed part of normal administration. Attackers also use scheduled tasks for persistence, but the presence of a task is not automatically malicious.

Correlate task events with authentication, administrator activity, endpoint telemetry and file-system evidence. Where attribution matters, focus on who created or changed the task rather than assuming the account under which it later ran identifies that person.

Operational takeaway¶

A scheduled-task event can explain automatically triggered activity, but investigators must separate task creation, task execution and program outcome before drawing conclusions about human presence, intent or attribution.