// question
On a Windows host, find any scheduled task that was registered using PowerShell native cmdlets instead of schtasks.exe. What was the name given to the new task?
Reference KQL answer and model-by-model comparison.
af9fd58f-c4ac-4bf2-a9ba-224b71ff25fd
question id
3/23
models correct
1
valid answer
13%
success rate
// reference answer
Human-validated correct answer for this question.
AtomicTask
// model comparison
| Model | Answer | KQL query | Status | Tries | Time | Cost |
|---|---|---|---|---|---|---|
| gemini-2.5-flash-preview-04-17 | "AtomicTask" | DeviceProcessEvents
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine contains "Register-ScheduledTask"
| extend TaskNameRaw = extract(@'-TaskName\s+(.*?)(?:\s+-|$)', 1, ProcessCommandLine)
| where isnotempty(TaskNameRaw)
| extend TaskName = trim_start('"', trim_start('\'', trim_end('"', trim_end('\'', TaskNameRaw)))) // Trim potential quotes
| extend TaskName = trim_start(' ', trim_end(' ', TaskName)) // Trim potential spaces
| project Timestamp, DeviceName, InitiatingProcessCommandLine, TaskName
| distinct Timestamp, DeviceName, TaskName, InitiatingProcessCommandLine | pass | 5 | 104.99s | 0.0749 |
| gpt-35-turbo | no answer | no query generated | fail | 5 | 0.00s | 0.0109 |
| gpt-4-turbo-2024-04-09 | no answer | no query generated | fail | 5 | 0.00s | 0.2423 |
| gpt-4.1 | no answer | no query generated | fail | 5 | 0.00s | 0.0362 |
| gpt-4.1-finetuned | no answer | no query generated | fail | 5 | 0.00s | 0.0337 |
| gpt-4.1-mini | no answer | no query generated | fail | 5 | 0.00s | 0.0072 |
| gpt-4.1-nano | no answer | no query generated | fail | 5 | 0.00s | 0.0013 |
| gpt-4o | no answer | no query generated | fail | 5 | 0.00s | 0.0533 |
| gpt-5-high | no answer | no query generated | fail | 5 | 0.00s | 0.2498 |
| gpt-5-mini-high | no answer | no query generated | fail | 5 | 0.00s | 0.0216 |
| gpt-5-mini-low | no answer | no query generated | fail | 5 | 0.00s | 0.0111 |
| gpt-5-mini-medium | no answer | no query generated | fail | 5 | 0.00s | 0.0195 |
| gpt-5-nano-high | no answer | no query generated | fail | 5 | 0.00s | 0.0089 |
| gpt-5-nano-medium | no answer | no query generated | fail | 5 | 0.00s | 0.0103 |
| grok-3-beta | AtomicTask | DeviceProcessEvents
| where InitiatingProcessFileName =~ 'powershell.exe'
| where ProcessCommandLine has_any ('New-ScheduledTask', 'Register-ScheduledTask')
| where ProcessCommandLine !has 'schtasks.exe'
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, TaskName = extract('(?i)TaskName\\s*=\\s*["]?([^"\\s]+)["]?', 1, ProcessCommandLine)
| order by Timestamp desc | pass | 3 | 19.69s | 0.0572 |
| grok-3-mini-beta | no answer | no query generated | fail | 5 | 0.00s | 0.0075 |
| o1-high | AtomicTask | DeviceProcessEvents
| where InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe", "powershell_ise.exe")
| where ProcessCommandLine has_any ("Register-ScheduledTask", "Set-ScheduledTask", "New-ScheduledTask")
| extend TaskNameQuoted = extract('-TaskName\\s+"([^"]+)"', 1, ProcessCommandLine)
| extend TaskNameUnquoted = extract('-TaskName\\s+(\\S+)', 1, ProcessCommandLine)
| extend ScheduledTaskName = coalesce(TaskNameQuoted, TaskNameUnquoted)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, ScheduledTaskName, ProcessCommandLine
| order by TimeGenerated desc | pass | 4 | 150.43s | 0.8065 |
| o1-low | None | DeviceProcessEvents
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("Register-ScheduledTask", "New-ScheduledTask")
| extend TaskName = extract("-TaskName\\s+\\\"([^\\\"]+)\\\"", 1, ProcessCommandLine)
| project TimeGenerated, DeviceName, AccountName, TaskName
| order by TimeGenerated desc | fail | 5 | 120.09s | 0.8895 |
| o3-high | no answer | no query generated | fail | 5 | 0.00s | 0.0848 |
| o3-mini-high | no answer | no query generated | fail | 5 | 0.00s | 0.0429 |
| o3-mini-low | no answer | no query generated | fail | 5 | 0.00s | 0.0409 |
| o4-mini-high | no answer | no query generated | fail | 5 | 0.00s | 0.0480 |
| o4-mini-low | no answer | no query generated | fail | 5 | 0.00s | 0.0579 |