Delete Important Scheduled Task

Title: Delete Important Scheduled Task
Status: test
Description:Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities
References:
  -Internal Research
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-09
modified:2026-03-11
Tags:

• -'attack.impact'
• -'attack.t1489'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\schtasks.exe' OriginalFileName:'schtasks.exe'   selection_cli_delete:
    CommandLine|contains|windash: '/delete'
  selection_cli_task:
    CommandLine|contains:
      -'\Windows\BitLocker'
      -'\Windows\ExploitGuard'
      -'\Windows\SystemRestore\SR'
      -'\Windows\UpdateOrchestrator\'
      -'\Windows\Windows Defender\'
      -'\Windows\WindowsBackup\'
      -'\Windows\WindowsUpdate\'

  condition:all of selection_*
Falsepositives:
  -Unlikely
Level: high