Important Scheduled Task Deleted or Disabled

Status: test
Severity: high
Log source: product windows, service taskscheduler
Author: frack113
Source: github.com/SigmaHQ/sigma

Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1489` Service Stop

Telemetry coverage

Provider	Record / event type
TaskScheduler	Event ID 141: User "TaskName" deleted Task Scheduler task "Name".
TaskScheduler	Event ID 142: User "TaskName" disabled Task Scheduler task "Name".

Rule body

title: Important Scheduled Task Deleted or Disabled
id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d
related:
    - id: dbc1f800-0fe0-4bc0-9c66-292c2abe3f78 # ProcCreation schtasks delete
      type: similar
    - id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad # Security-Audting Eventlog
      type: similar
    - id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980 # ProcCreation schtasks disable
      type: similar
status: test
description: |
    Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities
references:
    - https://www.socinvestigation.com/most-common-windows-event-ids-to-hunt-mind-map/
author: frack113
date: 2023-01-13
modified: 2026-03-11
tags:
    - attack.impact
    - attack.t1489
logsource:
    product: windows
    service: taskscheduler
    definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger'
detection:
    selection:
        EventID:
            - 141 # Task Deleted
            - 142 # Task Disabled
        TaskName|contains:
            - '\Windows\SystemRestore\SR'
            - '\Windows\Windows Defender\'
            - '\Windows\BitLocker'
            - '\Windows\WindowsBackup\'
            - '\Windows\WindowsUpdate\'
            - '\Windows\UpdateOrchestrator\'
            - '\Windows\ExploitGuard'
    filter_main_user:
        UserName|contains:
            - 'AUTHORI'
            - 'AUTORI'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high
regression_tests_path: regression_data/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable/info.yml
simulation:
    - type: atomic-red-team
      name: Windows - Disable the SR scheduled task
      technique: T1490
      atomic_guid: 1c68c68d-83a4-4981-974e-8993055fa034

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    EventID:
        - 141
        - 142
    TaskName|contains:
        - '\Windows\SystemRestore\SR'
        - '\Windows\Windows Defender\'
        - '\Windows\BitLocker'
        - '\Windows\WindowsBackup\'
        - '\Windows\WindowsUpdate\'
        - '\Windows\UpdateOrchestrator\'
        - '\Windows\ExploitGuard'

Stage 2: `not filter_main_user`

filter_main_user:
    UserName|contains:
        - 'AUTHORI'
        - 'AUTORI'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`UserName`	match	`AUTHORI`	`excludes:UserName` `field:"UserName" value:"AUTHORI"`
`UserName`	match	`AUTORI`	`excludes:UserName` `field:"UserName" value:"AUTORI"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TaskName`	match	`\Windows\BitLocker` corpus 2 (sigma 2) `\Windows\ExploitGuard` corpus 2 (sigma 2) `\Windows\SystemRestore\SR` corpus 2 (sigma 2) `\Windows\UpdateOrchestrator\` `\Windows\Windows Defender\` corpus 2 (sigma 2) `\Windows\WindowsBackup\` corpus 2 (sigma 2) `\Windows\WindowsUpdate\` corpus 2 (sigma 2)	`field:"TaskName" kind:match`