Open cardosec

Case 8C3079 · Blue team / DFIR · L3 Applied

A Rare Task on Three Laptops

Practise as: Incident drill · InterviewLevel: L3 Applied

Live alertA stacking hunt finds a scheduled task named "OneDrive Standalone Update Task-S-1-5-21" on just 3 of 8,000 laptops, all in finance. It runs rundll32.exe on a DLL in %APPDATA%\Roaming every 4 hours. No alert ever fired.

Interview questionYour hunt found a scheduled task that only exists on three finance laptops. What do you do?

  1. 01 What happened?
  2. 02 What is the impact?
  3. 03 What do you do?
Practise this card As Interview
What a strong answer covers

Try it out loud first. Then check yourself:

  1. Validate: compare with the real OneDrive task (name, author, path, signer); a DLL in AppData run by rundll32 is not how OneDrive updates.
  2. Scope: search all hosts for the task, the DLL hash and its outbound connections, and find when and how each task was created (event 4698).
  3. Treat it as an incident: isolate the three hosts, collect memory and the DLL, and check what the finance users accessed.
  4. Close the gap: turn the hunt query into a detection, and ask why EDR and existing rules missed it.

If the interviewer pushes back

  • The DLL is signed with a valid but unrelated vendor certificate. What does that tell you, and what do you do about trust in that certificate?

Go deeper

More Blue team / DFIR cards

All Blue team / DFIR cards →

cardosec draws a security topic and gives you a clock: explain it out loud with no notes, then see what you covered and what you missed. Free during early access.

Reviewed 2026-10-09