# Suspicious Scheduled Task Hunt Template

## Hunt Metadata
| Field | Value |
|-------|-------|
| Hunt ID | TH-SCHTASK-YYYY-MM-DD-NNN |
| Analyst | |
| Date | |
| Status | [ ] In Progress / [ ] Complete |

## Hypothesis
> Adversaries have established persistence via scheduled tasks that execute malicious payloads at system startup, user logon, or recurring intervals.

## Task Findings

| # | Host | Task Name | Action | Trigger | Created By | Created Time | Risk |
|---|------|-----------|--------|---------|-----------|-------------|------|
| 1 | | | | | | | |

## Recommendations
1. **Remove**: [Malicious scheduled tasks]
2. **Investigate**: [Executed payloads and their impact]
3. **Detect**: [Deploy 4698 monitoring rules]
4. **Baseline**: [Establish known-good task inventory]