Disable Important Scheduled Task

 1title: Disable Important Scheduled Task
 2id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980
 3related:
 4    - id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad # Security-Audting Eventlog
 5      type: similar
 6status: test
 7description: Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities
 8references:
 9    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-8---windows---disable-the-sr-scheduled-task
10    - https://twitter.com/MichalKoczwara/status/1553634816016498688
11    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
12author: frack113, Nasreddine Bencherchali (Nextron Systems)
13date: 2021/12/26
14modified: 2022/09/02
15tags:
16    - attack.impact
17    - attack.t1489
18logsource:
19    category: process_creation
20    product: windows
21detection:
22    schtasks_exe:
23        Image|endswith: '\schtasks.exe'
24        CommandLine|contains|all:
25            - '/Change'
26            - '/TN'
27            - '/disable'
28        CommandLine|contains:
29            # Add more important tasks
30            - '\Windows\SystemRestore\SR'
31            - '\Windows\Windows Defender\'
32            - '\Windows\BitLocker'
33            - '\Windows\WindowsBackup\'
34            - '\Windows\WindowsUpdate\'
35            - '\Windows\UpdateOrchestrator\'
36            - '\Windows\ExploitGuard'
37    condition: all of schtasks_*
38falsepositives:
39    - Unknown
40level: high

References

• atomic-red-team/atomics/T1490/T1490.md at f339e7da7d05f6057fdfcdd3742bfcf365fee2a9 · redcanaryco/atomic-red-team

  

  Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team

  
  Read More

• Something went wrong, but don’t fret — let’s give it another shot.

  
  Read More

• IcedID to XingLocker Ransomware in 24 hours

  

  In this intrusion, we observed the threat actors use multiple DLL Beacons that would call out to different Cobalt Strike C2 channels. The threat actors used batch scripts during the intrusion for a number of purposes, primarily to disable antivirus programs and execute payloads.

  
  Read More

Related rules

• Delete Important Scheduled Task
• Azure Application Deleted
• Audit CVE Event
• Azure Application Gateway Modified or Deleted
• Azure Application Security Group Modified or Deleted