Removal Of SD Value to Hide Schedule Task - Registry

 1title: Removal Of SD Value to Hide Schedule Task - Registry
 2id: acd74772-5f88-45c7-956b-6a7b36c294d2
 3related:
 4    - id: 526cc8bc-1cdc-48ad-8b26-f19bff969cec
 5      type: similar
 6status: test
 7description: Remove SD (Security Descriptor) value in \Schedule\TaskCache\Tree registry hive to hide schedule task. This technique is used by Tarrask malware
 8references:
 9    - https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/
10author: Sittikorn S
11date: 2022-04-15
12modified: 2025-10-25
13tags:
14    - attack.defense-evasion
15    - attack.t1562
16logsource:
17    product: windows
18    category: registry_delete
19detection:
20    selection:
21        TargetObject|contains|all:
22            - '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\'
23            - 'SD'
24    condition: selection
25falsepositives:
26    - Unknown
27level: medium
28regression_tests_path: regression_data/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_sd_value_removal/info.yml

References

• Tarrask malware uses scheduled tasks for defense evasion | Microsoft Security Blog

  

  Microsoft Detection and Response Team (DART) researchers have uncovered malware that creates “hidden” scheduled tasks as a defense evasion technique. In this post, we will demonstrate how threat actors create scheduled tasks, how they cover their tracks, and how the malware's evasion techniques are used to maintain and ensure persistence on systems.

  
  Read More

Related rules

• Removal Of Index Value to Hide Schedule Task - Registry
• AWS SecurityHub Findings Evasion
• FortiGate - Firewall Address Object Added
• FortiGate - New Firewall Policy Added
• WFP Filter Added via Registry