2 Replies Latest reply on May 20, 2014 3:33 AM by evileyes07

    Is it possible to create scheduled task creation alert on LEM?

    evileyes07

      Hi,

       

      Is there a way on LEM to create a rule that will generate an alert whenever a windows scheduled task is created? I've tried searching the forums but can't seem to find the right guide. I would like to monitor every scheduled task created on our servers and make sure that it is not created by malware/spyware (mostly named at#.job eg. At1.job etc).

       

      Any help would be very much appreciated.

       

      Regards,

      Neil

        • Re: Is it possible to create scheduled task creation alert on LEM?
          curtisi

          Yes, yes it is!

           

          I had to do some digging.  The first part of this is to make sure that you have the right audit policies in place on your machine or in your domain.  The category in Windows 7/8/2008 is "Other Object Access Events."  I was able to enable this on my local machine with the command:


          auditpol /set /subcategory:"Other Object Access Events" /failure:enable /success:enable

           

          Once that was done, I launched Task Scheduler and was able to get the following events in my LEM:

           

          ProcessInfoScheduled Task "\My Tasks\Sample" DeletedVista SecurityMicrosoft-Windows-Security-Auditing 4699
          ProcessInfoScheduled Task "\My Tasks\Sample" EnabledVista SecurityMicrosoft-Windows-Security-Auditing 4700
          ProcessInfoScheduled Task "\My Tasks\Sample" DisabledVista SecurityMicrosoft-Windows-Security-Auditing 4701
          ProcessInfoScheduled Task "\My Tasks\Sample" Created by "DOMAIN\UserName"Vista SecurityMicrosoft-Windows-Security-Auditing 4698

           

          As you can see, events were generated for the event being created, disabled, enabled, and deleted.  That should just about cover what you're looking for, right?  Obviously, the LEM would add the source account and machine, but I trimmed this to make it fit the post, and I didn't think that information was relevant to the answer.