Removal Of Index Value to Hide Schedule Task - Registry

calendar Jan 1, 2024 · attack.defense_evasion attack.t1562  ·
Share on: linkedin copy

Detects when the "index" value of a scheduled task is removed or deleted from the registry. Which effectively hides it from any tooling such as "schtasks /query"

Sigma rule (View on GitHub)

 1title: Removal Of Index Value to Hide Schedule Task - Registry
 2id: 526cc8bc-1cdc-48ad-8b26-f19bff969cec
 3related:
 4    - id: acd74772-5f88-45c7-956b-6a7b36c294d2
 5      type: similar
 6    - id: 5b16df71-8615-4f7f-ac9b-6c43c0509e61
 7      type: similar
 8status: test
 9description: Detects when the "index" value of a scheduled task is removed or deleted from the registry. Which effectively hides it from any tooling such as "schtasks /query"
10references:
11    - https://blog.qualys.com/vulnerabilities-threat-research/2022/06/20/defending-against-scheduled-task-attacks-in-windows-environments
12author: Nasreddine Bencherchali (Nextron Systems)
13date: 2022/08/26
14modified: 2023/02/08
15tags:
16    - attack.defense_evasion
17    - attack.t1562
18logsource:
19    product: windows
20    category: registry_delete
21detection:
22    selection:
23        EventType: DeleteKey
24        TargetObject|contains|all:
25            - '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\'
26            - 'Index'
27    condition: selection
28falsepositives:
29    - Unknown
30level: medium

References

Related rules

to-top