Is it possible to create scheduled task creation alert on LEM?

Question

Hi,

Is there a way on LEM to create a rule that will generate an alert whenever a windows scheduled task is created? I've tried searching the forums but can't seem to find the right guide. I would like to monitor every scheduled task created on our servers and make sure that it is not created by malware/spyware (mostly named at#.job eg. At1.job etc).

Any help would be very much appreciated.

Regards,

Neil

curtisi · Accepted Answer

Yes, yes it is!

I had to do some digging. The first part of this is to make sure that you have the right audit policies in place on your machine or in your domain. The category in Windows 7/8/2008 is "Other Object Access Events." I was able to enable this on my local machine with the command:

auditpol /set /subcategory:"Other Object Access Events" /failure:enable /success:enable

Once that was done, I launched Task Scheduler and was able to get the following events in my LEM:

ProcessInfo	Scheduled Task "\My Tasks\Sample" Deleted	Vista Security	Microsoft-Windows-Security-Auditing 4699
ProcessInfo	Scheduled Task "\My Tasks\Sample" Enabled	Vista Security	Microsoft-Windows-Security-Auditing 4700
ProcessInfo	Scheduled Task "\My Tasks\Sample" Disabled	Vista Security	Microsoft-Windows-Security-Auditing 4701
ProcessInfo	Scheduled Task "\My Tasks\Sample" Created by "DOMAIN\UserName"	Vista Security	Microsoft-Windows-Security-Auditing 4698

As you can see, events were generated for the event being created, disabled, enabled, and deleted. That should just about cover what you're looking for, right? Obviously, the LEM would add the source account and machine, but I trimmed this to make it fit the post, and I didn't think that information was relevant to the answer.

Is it possible to create scheduled task creation alert on LEM?

Top Replies