Delete Important Scheduled Task

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1489` Service Stop

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Delete Important Scheduled Task
id: dbc1f800-0fe0-4bc0-9c66-292c2abe3f78
related:
    - id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d # TaskScheduler EventLog
      type: similar
    - id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad # Security-Audting Eventlog
      type: similar
status: test
description: Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities
references:
    - Internal Research
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-09-09
modified: 2026-03-11
tags:
    - attack.impact
    - attack.t1489
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\schtasks.exe'
        - OriginalFileName: 'schtasks.exe'
    selection_cli_delete:
        CommandLine|contains|windash: '/delete'
    selection_cli_task:
        CommandLine|contains:
            # Add more important tasks
            - '\Windows\BitLocker'
            - '\Windows\ExploitGuard'
            - '\Windows\SystemRestore\SR'
            - '\Windows\UpdateOrchestrator\'
            - '\Windows\Windows Defender\'
            - '\Windows\WindowsBackup\'
            - '\Windows\WindowsUpdate\'
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_schtasks_delete/info.yml

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\schtasks.exe'
    - OriginalFileName: 'schtasks.exe'

Stage 2: `selection_cli_delete`

selection_cli_delete:
    CommandLine|contains|windash: '/delete'

Stage 3: `selection_cli_task`

selection_cli_task:
    CommandLine|contains:
        - '\Windows\BitLocker'
        - '\Windows\ExploitGuard'
        - '\Windows\SystemRestore\SR'
        - '\Windows\UpdateOrchestrator\'
        - '\Windows\Windows Defender\'
        - '\Windows\WindowsBackup\'
        - '\Windows\WindowsUpdate\'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`/delete` transforms: `windash` corpus 8 (sigma 6, splunk 2) `\Windows\BitLocker` corpus 2 (sigma 2) `\Windows\ExploitGuard` corpus 2 (sigma 2) `\Windows\SystemRestore\SR` corpus 2 (sigma 2) `\Windows\UpdateOrchestrator\` corpus 2 (sigma 2) `\Windows\Windows Defender\` corpus 2 (sigma 2) `\Windows\WindowsBackup\` corpus 2 (sigma 2) `\Windows\WindowsUpdate\` corpus 2 (sigma 2)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\schtasks.exe` corpus 55 (sigma 55)	`field:"Image" kind:ends_with value:"\schtasks.exe"`
`OriginalFileName`	eq	`schtasks.exe` corpus 31 (sigma 18, elastic 9, splunk 4)	`field:"OriginalFileName" kind:eq value:"schtasks.exe"`

Delete Important Scheduled Task

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_img

Stage 2: selection_cli_delete

Stage 3: selection_cli_task

Indicators

Stage 0: `condition`

Stage 1: `selection_img`

Stage 2: `selection_cli_delete`

Stage 3: `selection_cli_task`