Windows event log ยท Microsoft-Windows-TaskScheduler/Operational129 Scheduled Task created
- Windows operational
- 3 fields
Microsoft-Windows-TaskScheduler%4Operational.evtxMicrosoft-Windows-TaskScheduler
Fields EvtxECmd extracts
3 columns in the EvtxECmd CSV
- PayloadData1
Task: %TaskName%- %TaskName% = /Event/EventData/Data[@Name="TaskName"]
- ExecutableInfo
%Path%- %Path% = /Event/EventData/Data[@Name="Path"]
- PayloadData2
ProcessID: %ProcessID%- %ProcessID% = /Event/EventData/Data[@Name="ProcessID"]
Sample event
Event XML from the map file
<Event>
<System>
<Provider Name="Microsoft-Windows-TaskScheduler" Guid="de7b24ea-73c8-4a09-985d-5bdhwcfa9017"/>
<EventID>129</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>129</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2020-12-04 23:34:48.0504792"/>
<EventRecordID>298745</EventRecordID>
<Correlation/>
<Execution ProcessID="7436" ThreadID="4792"/>
<Channel>Microsoft-Windows-TaskScheduler/Operational</Channel>
<Computer>hostname.domain.com</Computer>
<Security UserID="S-1-5-18"/>
</System>
<EventData Name="CreatedTaskProcess">
<Data Name="TaskName">\GoogleUpdateTaskMachineUA</Data>
<Data Name="Path">C:\Program Files (x86)\Google\Update\GoogleUpdate.exe</Data>
<Data Name="ProcessID">1234</Data>
<Data Name="Priority">7</Data>
</EventData>
</Event>References
4 links
- intelligentsystemsmonitoring.com/knowledgebase/windows-operating-system/event-id-task-monitoring-and-control-12716/(opens in new tab)
- cyprich.com/2017/03/29/common-task-scheduler-event-ids/(opens in new tab)
- mnaoumov.wordpress.com/2014/05/15/task-scheduler-event-ids/(opens in new tab)
- github.com/nasbench/EVTX-ETW-Resources/blob/main/ETWProvidersCSVs/Internal/Microsoft-Windows-TaskScheduler.csv(opens in new tab)
Source: evtx/Maps/Microsoft-Windows-TaskScheduler-Operational_Microsoft-Windows-TaskScheduler_129.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)