Direct answer
Review the new task's creator, action, execution identity and triggers against the device's approved jobs and recent software changes.
Read the creation event
Microsoft documents event 4698 for task creation and includes task definition content in its example. Creation is not proof that the task executed or that it is malicious. Check whether task auditing and forwarding cover the affected device.
Reference: Microsoft: Security event 4698.
Inspect the definition
Record the task name, subject, event time and relevant definition fields, including executable, arguments, principal and trigger. Protect the event because task arguments can contain sensitive values. Compare the event with the current definition without running it.
Evaluate a concrete case
A software update task created by a managed installer may be legitimate. A task created by an unexpected account that launches an unknown script from a writable location should be checked against the change record, asset owner and process evidence. The task name alone is not a reliable classification.
Preserve and follow up
Investigate discrepancies with the security team and record whether execution evidence is available. Do not delete an unknown task before preserving evidence and checking dependencies. If an approved correction is made, verify the intended job and its next scheduled run.
A task may later be modified or deleted, so preserve both the creation event and the current definition when the approved investigation requires them.
Assessment limits
Audit settings and retention affect visibility, and a task can change after creation. The event does not establish whether its action succeeded.
Frequently asked questions
Does event 4698 prove a task ran?
No. It records creation; consult execution and task operational evidence separately.
Are all newly created tasks suspicious?
No. Applications and management tools create tasks routinely; verify their source and purpose.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.