Schedule Task with Rundll32 Command Trigger

Description

The following analytic detects the creation of scheduled tasks in Windows that use the rundll32 command. It leverages Windows Security EventCode 4698, which logs the creation of scheduled tasks, and filters for tasks executed via rundll32. This activity is significant as it is a common technique used by malware, such as TrickBot, to persist in an environment or deliver additional payloads. If confirmed malicious, this could lead to data theft, ransomware deployment, or other damaging outcomes. Immediate investigation and mitigation are crucial to prevent further compromise.

Query · spl

`wineventlog_security` EventCode=4698
  | xmlkv Message
  | search Command IN ("*rundll32*")
  | stats count min(_time) as firstTime max(_time) as lastTime
    BY dest, Task_Name, Command,
       Author, Enabled, Hidden,
       Arguments
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`
  | `schedule_task_with_rundll32_command_trigger_filter`

Implementation guide

To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment.

Known false positives

  • No false positives have been identified at this time.

Analyst notes

Known false positives: No false positives have been identified at this time.

Raw source Schedule Task with Rundll32 Command Trigger · SPL
Esc
Published by splunk/security_content ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
name: Schedule Task with Rundll32 Command Trigger
id: 75b00fd8-a0ff-11eb-8b31-acde48001122
version: 12
creation_date: '2021-04-26'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the creation of scheduled tasks in Windows that use the rundll32 command. It leverages Windows Security EventCode 4698, which logs the creation of scheduled tasks, and filters for tasks executed via rundll32. This activity is significant as it is a common technique used by malware, such as TrickBot, to persist in an environment or deliver additional payloads. If confirmed malicious, this could lead to data theft, ransomware deployment, or other damaging outcomes. Immediate investigation and mitigation are crucial to prevent further compromise.
data_source:
    - Windows Event Log Security 4698
search: |-
    `wineventlog_security` EventCode=4698
      | xmlkv Message
      | search Command IN ("*rundll32*")
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest, Task_Name, Command,
           Author, Enabled, Hidden,
           Arguments
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `schedule_task_with_rundll32_command_trigger_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment.
known_false_positives: No false positives have been identified at this time.
references:
    - https://labs.vipre.com/trickbot-and-its-modules/
    - https://whitehat.eu/incident-response-case-study-featuring-ryuk-and-trickbot-part-2/
drilldown_searches:
    - name: View the detection results for - "$dest$"
      search: '%original_detection_search% | search  dest = "$dest$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$dest$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
finding:
    title: A scheduled task process commandline rundll32 arguments $Arguments$ on host $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Persistence Techniques
    - Living Off The Land
    - IcedID
    - Scheduled Tasks
    - Compromised Windows Host
    - Trickbot
    - Castle RAT
asset_type: Endpoint
mitre_attack_id:
    - T1053
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/tasksched/windows-security.log
          source: WinEventLog:Security
          sourcetype: WinEventLog
      test_type: unit

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.