Scheduled Task Deletion

Status: test
Severity: low
Log source: product windows, service security
Author: David Strassegger, Tim Shelton
Source: github.com/SigmaHQ/sigma

Detects scheduled task deletion events. Scheduled tasks are likely to be deleted if not used for persistence. Malicious Software often creates tasks directly under the root node e.g. \TASKNAME

Known false positives

Software installation

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1053.005` Scheduled Task/Job: Scheduled Task
Persistence	`T1053.005` Scheduled Task/Job: Scheduled Task
Privilege Escalation	`T1053.005` Scheduled Task/Job: Scheduled Task

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4699: A scheduled task was deleted.

Rule body

title: Scheduled Task Deletion
id: 4f86b304-3e02-40e3-aa5d-e88a167c9617
status: test
description: Detects scheduled task deletion events. Scheduled tasks are likely to be deleted if not used for persistence. Malicious Software often creates tasks directly under the root node e.g. \TASKNAME
references:
    - https://twitter.com/matthewdunwoody/status/1352356685982146562
    - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4699
author: David Strassegger, Tim Shelton
date: 2021-01-22
modified: 2023-01-20
tags:
    - attack.execution
    - attack.privilege-escalation
    - attack.persistence
    - car.2013-08-001
    - attack.t1053.005
    - detection.threat-hunting
logsource:
    product: windows
    service: security
    definition: 'Requirements: The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data.'
detection:
    selection:
        EventID: 4699
    filter_main_generic:
        TaskName: '\Microsoft\Windows\RemovalTools\MRT_ERROR_HB' # Triggered by ParentCommandLine=C:\WINDOWS\system32\MRT.exe /EHB /HeartbeatFailure ErrorStack,Previous=ErrorStack,Previous=ErrorStack,Previous=ErrorStack,Previous=ErrorStack,Previous=SubmitHeartbeatReportData,Hr=0x80072f8f,Hr=0x80072f8f,Hr=0x80072f8f,Hr=0x80072f8f,Hr=0x80072f8f /HeartbeatError 0x80072f8f
    filter_main_firefox:
        TaskName|contains: '\Mozilla\Firefox Default Browser Agent ' # Triggered by firefox updates
    condition: selection and not 1 of filter_*
falsepositives:
    - Software installation
level: low

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_*

Stage 1: `selection`

selection:
    EventID: 4699

Stage 2: `not filter_*`

filter_main_generic:
    TaskName: '\Microsoft\Windows\RemovalTools\MRT_ERROR_HB'
filter_main_firefox:
    TaskName|contains: '\Mozilla\Firefox Default Browser Agent '

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`TaskName`	eq	`\Microsoft\Windows\RemovalTools\MRT_ERROR_HB`	`excludes:TaskName` `field:"TaskName" value:"\Microsoft\Windows\RemovalTools\MRT_ERROR_HB"`
`TaskName`	match	`\Mozilla\Firefox Default Browser Agent`	`excludes:TaskName` `field:"TaskName" value:"\Mozilla\Firefox Default Browser Agent "`