Delete Important Scheduled Task

 1title: Delete Important Scheduled Task
 2id: dbc1f800-0fe0-4bc0-9c66-292c2abe3f78
 3related:
 4    - id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d # TaskScheduler EventLog
 5      type: similar
 6    - id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad # Security-Audting Eventlog
 7      type: similar
 8status: test
 9description: Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities
10references:
11    - Internal Research
12author: Nasreddine Bencherchali (Nextron Systems)
13date: 2022-09-09
14modified: 2026-03-11
15tags:
16    - attack.impact
17    - attack.t1489
18logsource:
19    category: process_creation
20    product: windows
21detection:
22    selection_img:
23        - Image|endswith: '\schtasks.exe'
24        - OriginalFileName: 'schtasks.exe'
25    selection_cli_delete:
26        CommandLine|contains|windash: '/delete'
27    selection_cli_task:
28        CommandLine|contains:
29            # Add more important tasks
30            - '\Windows\BitLocker'
31            - '\Windows\ExploitGuard'
32            - '\Windows\SystemRestore\SR'
33            - '\Windows\UpdateOrchestrator\'
34            - '\Windows\Windows Defender\'
35            - '\Windows\WindowsBackup\'
36            - '\Windows\WindowsUpdate\'
37    condition: all of selection_*
38falsepositives:
39    - Unlikely
40level: high
41regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_schtasks_delete/info.yml