Important Scheduled Task Deleted or Disabled

Title: Important Scheduled Task Deleted or Disabled
Status: test
Description:Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities
References:
  -https://www.socinvestigation.com/most-common-windows-event-ids-to-hunt-mind-map/
Author: frack113
Date: 2023-01-13
modified:2026-03-11
Tags:

• -'attack.impact'
• -'attack.t1489'

Logsource:

• product: windows
• service: taskscheduler
• definition: Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger

Detection:
  selection:
    EventID:
      -'141'
      -'142'

    TaskName|contains:
      -'\Windows\SystemRestore\SR'
      -'\Windows\Windows Defender\'
      -'\Windows\BitLocker'
      -'\Windows\WindowsBackup\'
      -'\Windows\WindowsUpdate\'
      -'\Windows\UpdateOrchestrator\'
      -'\Windows\ExploitGuard'

  filter_main_user:
    UserName|contains:
      -'AUTHORI'
      -'AUTORI'

  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: high