Disable Important Scheduled Task
Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
detection:
selection_img:
- Image|endswith: '\schtasks.exe'
- OriginalFileName: 'schtasks.exe'
selection_cli_disable:
CommandLine|contains|windash: '/disable'
selection_cli_task:
CommandLine|contains:
# Add more important tasks
- '\Windows\BitLocker'
- '\Windows\ExploitGuard'
- '\Windows\ExploitGuard\ExploitGuard MDM policy Refresh'
- '\Windows\SystemRestore\SR'
- '\Windows\UpdateOrchestrator\'
- '\Windows\Windows Defender\'
- '\Windows\WindowsBackup\'
- '\Windows\WindowsUpdate\'
condition: all of selection_*False positive likelihood has not been assessed. Additional context may be needed during triage.
Simulations
Windows - Disable the SR scheduled task
GUID: 1c68c68d-83a4-4981-974e-8993055fa034
Tactics
Techniques
Important Scheduled Task Deleted/Disabled
Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities
Detects similar activity. Both rules may fire on overlapping events.
Important Scheduled Task Deleted or Disabled
Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities
Detects similar activity. Both rules may fire on overlapping events.