Disable Important Scheduled Task

 1title: Disable Important Scheduled Task
 2id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980
 3related:
 4    - id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad # Security-Audting Eventlog
 5      type: similar
 6    - id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d # TaskScheduler EventLog
 7      type: similar
 8status: test
 9description: Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities
10references:
11    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-8---windows---disable-the-sr-scheduled-task
12    - https://twitter.com/MichalKoczwara/status/1553634816016498688
13    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
14author: frack113, Nasreddine Bencherchali (Nextron Systems), X__Junior
15date: 2021-12-26
16modified: 2026-03-11
17tags:
18    - attack.impact
19    - attack.t1489
20logsource:
21    category: process_creation
22    product: windows
23detection:
24    selection_img:
25        - Image|endswith: '\schtasks.exe'
26        - OriginalFileName: 'schtasks.exe'
27    selection_cli_disable:
28        CommandLine|contains|windash: '/disable'
29    selection_cli_task:
30        CommandLine|contains:
31            # Add more important tasks
32            - '\Windows\BitLocker'
33            - '\Windows\ExploitGuard'
34            - '\Windows\ExploitGuard\ExploitGuard MDM policy Refresh'
35            - '\Windows\SystemRestore\SR'
36            - '\Windows\UpdateOrchestrator\'
37            - '\Windows\Windows Defender\'
38            - '\Windows\WindowsBackup\'
39            - '\Windows\WindowsUpdate\'
40    condition: all of selection_*
41falsepositives:
42    - Unknown
43level: high
44regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_schtasks_disable/info.yml
45simulation:
46    - type: atomic-red-team
47      name: Windows - Disable the SR scheduled task
48      technique: T1490
49      atomic_guid: 1c68c68d-83a4-4981-974e-8993055fa034