You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?

The process taskeng.exe is the Task Scheduler Engine for Windows. Its involvement in a detection indicates that a scheduled task was likely used to execute a malicious payload or maintain persistence. The logical investigative step is to examine the scheduled tasks that were created on the host prior to the detection to identify the malicious entry. This allows the analyst to understand the initial execution vector or persistence mechanism used by the adversary.

A. User logons are a separate activity and less directly related to a taskeng.exe execution than the scheduled task itself.
B. Investigating schtasks.exe executions after the detection would miss the task that caused the alert.
D. taskeng.exe is a legitimate, signed Windows binary. Searching for its hash would be uninformative and generate noise.

1. CrowdStrike, Inc. (2023). Falcon Platform for Windows: Sensor for Windows Deployment Guide. "Troubleshooting" section. While not a direct guide, it establishes the context of Windows processes. The investigative logic follows standard incident response principles for scheduled task abuse.

2. Microsoft. (2021). Task Scheduler. Microsoft Docs. This document describes the function of the Task Scheduler and its components, including taskeng.exe, confirming its role in running tasks. This foundational knowledge is essential for the CCFR exam.