At a manufacturer, event 4698 records a new task whose action is a script in a temp directory, and event 4688 shows that script starting at the task time. What do the two events show together?
Select an answer to reveal the explanation.
Short Explanation
An alarm clock rang, and the machine you set it to start actually started. You have a scheduled task created to run a temp-directory script, then that script starting on time. The trap is reading a deleted user, a firewall block, or a revoked certificate into those two events.
Full Explanation
Event 4698 records that a scheduled task was created. Event 4688 records that a new process was created. Together, a task whose action is a script in a temp directory, plus that script starting at the task time, supports one story: the scheduled task ran the script. The combined reading is "A scheduled task was created to launch the temp-directory script, and that script then started". "A user account was deleted on the plant host in the same window the temp-directory script appeared" would be an account-deletion event, and neither 4698 nor 4688 records a deleted account. "The host firewall blocked the script, and no new process was recorded at the task time" contradicts the 4688 process start, so the script was not blocked into silence. "The certificate for the plant web service was revoked at the moment the script started" is a certificate-status change, and these events do not describe a certificate. Exam caveat: 4688 is not assumed to be present on every host; this scenario gives you the process event, and a missing 4688 elsewhere would not prove a script never ran. Operational check: match the task action path to the 4688 process name and compare the two timestamps, then preserve the script file before the task is deleted.