Detectionhightest

Important Scheduled Task Deleted or Disabled

Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
François HubautCreated Fri Jan 13Updated Wed Mar 119e3cb244-bdb8-4632-8c90-6079c8f4f16dwindows
Log Source
Windowstaskscheduler
ProductWindows← raw: windows
Servicetaskscheduler← raw: taskscheduler

Definition

Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger

Detection Logic
Detection Logic2 selectors
detection:
    selection:
        EventID:
            - 141 # Task Deleted
            - 142 # Task Disabled
        TaskName|contains:
            - '\Windows\SystemRestore\SR'
            - '\Windows\Windows Defender\'
            - '\Windows\BitLocker'
            - '\Windows\WindowsBackup\'
            - '\Windows\WindowsUpdate\'
            - '\Windows\UpdateOrchestrator\'
            - '\Windows\ExploitGuard'
    filter_main_user:
        UserName|contains:
            - 'AUTHORI'
            - 'AUTORI'
    condition: selection and not 1 of filter_main_*
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

Testing & Validation

Simulations

atomic-red-teamT1490
View on ART

Windows - Disable the SR scheduled task

GUID: 1c68c68d-83a4-4981-974e-8993055fa034

Regression Tests

by Swachchhanda Shrawan Poudel (Nextron Systems)
Positive Detection Test1 matchevtx

Microsoft-Windows-Sysmon