agentsclimarketplace
Sign in

Hunting scheduled task abuse

Skill meltedinhex/analyst-ai-pack/skills/hunting-scheduled-task-abuse

Hunts for malicious scheduled task persistence by analyzing task registration events (4698) and schtasks process creation for suspicious actions, triggers, and hidden tasks. Activates for requests to hunt scheduled task abuse, detect malicious schtasks usage, or find persistence via the Task Scheduler.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill hunting-scheduled-task-abuse

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.6 KB, 439 tokens by cl100k_base, as published. Nobody here has run it

Hunting Scheduled Task Abuse

When to Use

  • You have task-registration events (4698) and/or schtasks.exe/at.exe process telemetry and want to detect persistence via malicious scheduled tasks.
  • You are investigating tasks that run scripts, encoded commands, or binaries from suspicious paths.

Do not use this to alert on all task creation — administration creates tasks routinely. Hunt on the action (script hosts, encoded commands, temp paths) and trigger context.

Prerequisites

  • Event ID 4698 (task registered) and/or process-creation telemetry for schtasks/at.

Workflow

Step 1: Hunt suspicious task actions

python scripts/analyst.py hunt events.csv

Flags tasks whose action runs powershell -enc, mshta, wscript/cscript, cmd /c, or binaries from %TEMP%/%APPDATA%/Public, and schtasks /create command lines with the same.

Step 2: Assess triggers and hiding

Note logon/onstart triggers, very frequent intervals, and tasks hidden via Hidden flag or SD manipulation.

Step 3: Confirm

Distinguish legitimate software tasks from intrusion by author, path, and action content.

Step 4: Operationalize

Write a Sigma rule for task actions invoking script hosts or encoded commands.

Validation

  • Flags require a suspicious action/path, not task creation alone.
  • schtasks /create and 4698 registrations are both covered.
  • Findings map to ATT&CK T1053.005.

Pitfalls

  • Legitimate updater tasks (browsers, vendors) creating many tasks.
  • Tasks created via direct XML drop bypassing schtasks.exe telemetry.
  • Encoded commands hiding the true action.

References

What ships with it: 3 files

4.2 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.