Delete Important Scheduled Task

 1title: Delete Important Scheduled Task
 2id: dbc1f800-0fe0-4bc0-9c66-292c2abe3f78
 3related:
 4    - id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d # TaskScheduler EventLog
 5      type: similar
 6    - id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad # Security-Audting Eventlog
 7      type: similar
 8status: test
 9description: Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities
10references:
11    - Internal Research
12author: Nasreddine Bencherchali (Nextron Systems)
13date: 2022/09/09
14tags:
15    - attack.impact
16    - attack.t1489
17logsource:
18    category: process_creation
19    product: windows
20detection:
21    schtasks_exe:
22        Image|endswith: '\schtasks.exe'
23        CommandLine|contains|all:
24            - '/delete'
25            - '/tn'
26        CommandLine|contains:
27            # Add more important tasks
28            - '\Windows\SystemRestore\SR'
29            - '\Windows\Windows Defender\'
30            - '\Windows\BitLocker'
31            - '\Windows\WindowsBackup\'
32            - '\Windows\WindowsUpdate\'
33            - '\Windows\UpdateOrchestrator\'
34            - '\Windows\ExploitGuard'
35    condition: all of schtasks_*
36falsepositives:
37    - Unlikely
38level: high