Deleting Windows Defender scheduled tasks

calendar May 9, 2022 · attack.defense_evasion attack.t1562.001  ·
Share on: linkedin copy

Detects the deletion of scheduled tasks related to Windows Defender.

Sigma rule (View on GitHub)

 1title: Deleting Windows Defender scheduled tasks
 2status: Experimental
 3description: Detects the deletion of scheduled tasks related to Windows Defender.
 4author: \@Kostastsale, \@TheDFIRReport
 5references: 
 6  - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/
 7date: 2022/05/09
 8logsource:
 9  product: windows
10  category: process_creation
11detection:
12  selection1:
13    Image|endswith: '\schtasks.exe'
14    CommandLine|contains|all:
15      - '/delete'
16      - '/tn'
17      - 'Windows Defender'
18  condition: selection1
19falsepositives:
20  - Uknown
21level: high
22tags:
23  - attack.defense_evasion
24  - attack.t1562.001```

References

  • SEO Poisoning - A Gootloader Story

    In early February 2022, we witnessed an intrusion employing Gootloader (aka GootKit) as the initial access vector.The intrusion lasted two days and comprised discovery, persistence, lateral movement, collection, defense evasion, credential access and command and control activity.


    Read More

Related rules

to-top