splunk_escuTTP

Schedule Task with Rundll32 Command Trigger

The following analytic detects the creation of scheduled tasks in Windows that use the rundll32 command. It leverages Windows Security EventCode 4698, which logs the creation of scheduled tasks, and filters for tasks executed via rundll32. This activity is significant as it is a common technique used by malware, such as TrickBot, to persist in an environment or deliver additional payloads. If confirmed malicious, this could lead to data theft, ransomware deployment, or other damaging outcomes. Immediate investigation and mitigation are crucial to prevent further compromise.

MITRE ATT&CK

T1053

executionpersistenceprivilege-escalation

Detection Query

`wineventlog_security` EventCode=4698
  | xmlkv Message
  | search Command IN ("*rundll32*")
  | stats count min(_time) as firstTime max(_time) as lastTime
    BY dest, Task_Name, Command,
       Author, Enabled, Hidden,
       Arguments
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`
  | `schedule_task_with_rundll32_command_trigger_filter`

Author

Teoderick Contreras, Splunk

Created

2026-03-10

Data Sources

Windows Event Log Security 4698

References

Tags

Windows Persistence TechniquesLiving Off The LandIcedIDScheduled TasksCompromised Windows HostTrickbotCastle RAT

Raw Content

name: Schedule Task with Rundll32 Command Trigger
id: 75b00fd8-a0ff-11eb-8b31-acde48001122
version: 10
date: '2026-03-10'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the creation of scheduled tasks in Windows that use the rundll32 command. It leverages Windows Security EventCode 4698, which logs the creation of scheduled tasks, and filters for tasks executed via rundll32. This activity is significant as it is a common technique used by malware, such as TrickBot, to persist in an environment or deliver additional payloads. If confirmed malicious, this could lead to data theft, ransomware deployment, or other damaging outcomes. Immediate investigation and mitigation are crucial to prevent further compromise.
data_source:
    - Windows Event Log Security 4698
search: |-
    `wineventlog_security` EventCode=4698
      | xmlkv Message
      | search Command IN ("*rundll32*")
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest, Task_Name, Command,
           Author, Enabled, Hidden,
           Arguments
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `schedule_task_with_rundll32_command_trigger_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment.
known_false_positives: No false positives have been identified at this time.
references:
    - https://labs.vipre.com/trickbot-and-its-modules/
    - https://whitehat.eu/incident-response-case-study-featuring-ryuk-and-trickbot-part-2/
drilldown_searches:
    - name: View the detection results for - "$dest$"
      search: '%original_detection_search% | search  dest = "$dest$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$dest$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
rba:
    message: A scheduled task process commandline rundll32 arguments $Arguments$ on host $dest$
    risk_objects:
        - field: dest
          type: system
          score: 50
    threat_objects: []
tags:
    analytic_story:
        - Windows Persistence Techniques
        - Living Off The Land
        - IcedID
        - Scheduled Tasks
        - Compromised Windows Host
        - Trickbot
        - Castle RAT
    asset_type: Endpoint
    mitre_attack_id:
        - T1053
    product:
        - Splunk Enterprise
        - Splunk Enterprise Security
        - Splunk Cloud
    security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/tasksched/windows-security.log
          source: WinEventLog:Security
          sourcetype: WinEventLog