Removal Of SD Value to Hide Schedule Task - Registry

Title: Removal Of SD Value to Hide Schedule Task - Registry
Status: test
Description:Remove SD (Security Descriptor) value in \Schedule\TaskCache\Tree registry hive to hide schedule task. This technique is used by Tarrask malware
References:
  -https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/
Author: Sittikorn S
Date: 2022-04-15
modified:2025-10-25
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• product: windows
• category: registry_delete

Detection:
  selection:
    TargetObject|contains|all:
      -'\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\'
      -'SD'

  condition:selection
Falsepositives:
  -Unknown
Level: medium