Delete All Scheduled Tasks

Title: Delete All Scheduled Tasks
Status: test
Description:Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.
References:
  -https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-delete
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-09
modified:None
Tags:

• -'attack.impact'
• -'attack.t1489'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains|all:
      -' /delete '
      -'/tn \*'
      -' /f'

  condition:selection
Falsepositives:
  -Unlikely
Level: high