Question

While reviewing Windows Security logs on a workstation flagged by the SOC, an analyst finds Event ID 4698 recorded shortly after a suspicious PowerShell session. The event shows a new task named 'SystemUpdateCheck' configured to run an executable from a user's AppData folder every 30 minutes. What activity does this log entry most directly indicate?

Accepted Answer

An attacker establishing persistence by creating a scheduled task

Answer

A legitimate Windows Update service performing a routine integrity check

Answer

An interactive user logon initiated from a remote host

Answer

A privilege escalation attempt exploiting a service misconfiguration