How do you detect remote scheduled task lateral movement?

Detect it by proving a task was created remotely and reading what it runs. Security Event ID 4698 records the task XML and the creator’s logon ID; if that logon ID belongs to a type 3 network logon on the same host, the task came over the network. Check the XML for SYSTEM principals, one-time triggers that fire immediately and suspicious commands, and look for 4699 deletion seconds later. On the client side, alert on schtasks.exe with /s and /create, and on atsvc pipe access in Event 5145. Microsoft-Windows-TaskScheduler/Operational events 106 and 200 add timing. Remember to enable the Other Object Access audit category.

Detecting Remote Scheduled Task Creation and schtasks Abuse

The Task Scheduler RPC interface lets an administrator create a task on a remote host, run it immediately and delete it. schtasks /create /s, PowerShell’s ScheduledTasks module and Impacket’s atexec.py all use it. The creation event records the task XML, so you can read what it will run.

Signals at a Glance

Signal	Where	ATT&CK
Task created (4698) in a session that began with a type 3 logon	Security 4698 + 4624	T1053.005
Task registered (106) and started (200) with a one-time trigger and immediate run	TaskScheduler/Operational	T1053.005
schtasks.exe with /s, /create and /ru SYSTEM on the command line	Sysmon 1, Event 4688	T1053.005
IPC$ access to the atsvc pipe	Security 5145, Zeek smb	T1021.002
Task created and deleted (4699) within seconds	Security 4698/4699	T1053.005

Proving the Task Was Remote

Event 4698 includes the creator’s logon ID. If that ID belongs to a type 3 (network) logon on the same machine, the task was not created at a console. That correlation separates remote creation from local administration far better than the task name does. Auditing note: enable Audit Other Object Access Events or 4698 will never appear.

// Sentinel (KQL) - scheduled task created from a network logon session
SecurityEvent
| where EventID == 4698
| project TaskTime=TimeGenerated, Computer, TaskName, TaskContent, SubjectUserName, SubjectLogonId
| join kind=inner (
    SecurityEvent
    | where EventID == 4624 and LogonType == 3
    | project LogonTime=TimeGenerated, Computer, TargetLogonId, SourceIp=IpAddress
) on Computer, $left.SubjectLogonId == $right.TargetLogonId
| extend RunsAsSystem = TaskContent has "S-1-5-18" or TaskContent has "SYSTEM"
| extend Immediate = TaskContent has "TimeTrigger"
| project TaskTime, Computer, TaskName, SubjectUserName, SourceIp, RunsAsSystem, Immediate
// tune/validate: patching tools create network-origin tasks; allowlist by task path and account.

In Splunk, hunt the client side. schtasks.exe with a remote target is easy to match, and attackers rarely hide the switch:

index=sysmon EventCode=1 (Image="*\\schtasks.exe" OR OriginalFileName="schtasks.exe")
  CommandLine="* /s *" OR CommandLine="* /S *" OR CommandLine="*\\\\*"
  CommandLine="*/create*"
| eval runs_as_system=if(match(CommandLine, "(?i)/ru\s+(system|\"nt authority)"), 1, 0)
| stats count values(CommandLine) as cmds by Computer, User, ParentImage, runs_as_system
| sort - runs_as_system, - count
# tune/validate: SIEM-specific quoting; test the regex against a known schtasks sample first.

Reading the Task

Parse the task XML in 4698: the Command and Arguments elements, the principal (SYSTEM versus a user) and the trigger. A one-time or boot trigger that fires within a minute is typical of remote execution.
Impacket atexec.py registers a randomly named task, runs it as SYSTEM, writes output to a file under the Windows temp area and deletes the task. Random names plus quick deletion are the pattern.
TaskScheduler/Operational Event 106 (registered), 140 (updated), 141 (deleted), 200 (action started) and 201 (completed) give timing even when Security auditing is incomplete.
Persistence tasks differ: they stay. Alert on tasks created from network sessions and left in place with logon or daily triggers, particularly under non-Microsoft task paths.

Vetted sources

Use the SigmaHQ scheduled-task rules, Elastic and Splunk ESCU scheduled-task content and MITRE CAR analytics for remote task creation. Atomic Red Team provides schtasks and atexec tests, and the Sysmon configurations from SwiftOnSecurity and Olaf Hartong capture process creation. Baseline your own environment: software deployment and backup agents routinely register tasks remotely.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Proving the Task Was Remote

Reading the Task

Build Detections That Fire

Lateral Movement Detection

Detection Hub

Remote Service Creation Detection

DCOM Lateral Movement Detection