MDE - Scheduled Task Execution

MDE Schedulted Tasks

Query

let devicescope = (DeviceInfo
| summarize arg_max(TimeGenerated,*) by DeviceId
| where OnboardingStatus == 'Onboarded'
| where OSPlatform startswith "WindowsServer"
|  project DeviceName, DeviceId);
let runningtasks = (
DeviceProcessEvents
| where ActionType == @"ProcessCreated"
| where InitiatingProcessFileName =~ "svchost.exe"
| where InitiatingProcessCommandLine has "Schedule"
| extend TaskRunContext = AccountName
| project
   Timestamp,
   DeviceName,
   DeviceId,
   TaskRunContext,
   AccountDomain,
   AccountSid,
   FileName,
   ProcessCommandLine,
   InitiatingProcessFileName,
   InitiatingProcessCommandLine,
   InitiatingProcessAccountName
| order by Timestamp desc);
devicescope
| join kind=leftouter (runningtasks)
on $left. DeviceId == $right. DeviceId
| project-away DeviceId1, DeviceId1, DeviceName1, DeviceId

About this query

Explanation

This KQL query is designed to provide an overview of scheduled tasks running on Windows Server devices in your environment. It consists of two main parts:

Scheduled Task Executions on Servers:
- The query first identifies devices that are onboarded and running Windows Server.
- It then looks for processes that were created by the Task Scheduler (svchost.exe with "Schedule" in the command line).
- It filters for processes that are specifically cmd.exe, powershell.exe, or cscript.exe.
- It excludes tasks run by system accounts like 'system', 'local service', and 'network service', focusing on custom accounts.
- The result is a list of scheduled tasks executed by custom accounts, showing details like the task's context, command line, and initiating process.
Scheduled Task Intervals:
- This part of the query analyzes task execution over the past 7 days.
- It calculates the intervals between task executions to infer the scheduling pattern.
- It summarizes the execution behavior, including the first and last seen times, execution count, and interval statistics (minimum, average, maximum).
- It attempts to guess a human-readable schedule pattern (e.g., "Every ~15 minutes", "Daily").
- The output includes details like the device name, account running the task, executed file, inferred schedule pattern, and command line.

Overall, this query helps you understand which scheduled tasks are running, who is running them, and how frequently they are executed on your Windows Server devices.

Details

Alex Verboon

Released: June 29, 2026

Tables

DeviceInfoDeviceProcessEvents

Keywords

DeviceInfoDeviceProcessEventsDeviceNameDeviceIdTaskRunContextAccountDomainAccountSidFileNameProcessCommandLineInitiatingProcessFileNameInitiatingProcessCommandLineInitiatingProcessAccountNameProcessIdTimestampRunAsAccountExecutedFileCommandLineExecutionCountFirstSeenLastSeenMinIntervalMinutesAvgIntervalMinutesMaxIntervalMinutesObservedIntervalsInferredSchedulePattern

Operators

letsummarizearg_maxbywherestartswithprojectextendorder byjoinkindonproject-awayin!inagohasstrcatsort byserializeprevdatetime_diffminmaxcountroundavgmake_setcasebetweentostring

Actions

GitHub

KQL Search