attack.t1489

Delete All Scheduled Tasks

Oct 28, 2023 · attack.impact attack.t1489 ·

Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.

Application Uninstalled

Oct 18, 2023 · attack.impact attack.t1489 ·

Share on:

An application has been removed. Check if it is critical.

Stop Windows Service Via Net.EXE

Oct 18, 2023 · attack.impact attack.t1489 ·

Share on:

Detects the stopping of a Windows service

Stop Windows Service Via PowerShell Stop-Service

Oct 18, 2023 · attack.impact attack.t1489 ·

Share on:

Detects the stopping of a Windows service

Stop Windows Service Via Sc.EXE

Oct 18, 2023 · attack.impact attack.t1489 ·

Share on:

Detects the stopping of a Windows service

Suspicious Windows Service Tampering

Oct 18, 2023 · attack.defense_evasion attack.t1489 ·

Share on:

Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts

Delete Important Scheduled Task

Oct 17, 2023 · attack.impact attack.t1489 ·

Share on:

Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities

Disable Important Scheduled Task

Oct 17, 2023 · attack.impact attack.t1489 ·

Share on:

Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities

Azure Application Deleted

Oct 12, 2023 · attack.defense_evasion attack.impact attack.t1489 ·

Share on:

Identifies when a application is deleted in Azure.

Important Scheduled Task Deleted

Feb 8, 2023 · attack.impact attack.t1489 ·

Share on:

Detects when adversaries try to stop system services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities