Detection rules › Sigma

Important Scheduled Task Deleted/Disabled

Severity
high
Author
Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1053.005 Scheduled Task/Job: Scheduled Task
PersistenceT1053.005 Scheduled Task/Job: Scheduled Task
Privilege EscalationT1053.005 Scheduled Task/Job: Scheduled Task

Event coverage

ProviderEvent IDTitle
Security-Auditing4699A scheduled task was deleted.
Security-Auditing4701A scheduled task was disabled.

Stages and Predicates

Stage 1: selection

or:
TaskName|contains: '\Windows\BitLocker'
TaskName|contains: '\Windows\ExploitGuard'
TaskName|contains: '\Windows\SystemRestore\SR'
TaskName|contains: '\Windows\UpdateOrchestrator\Schedule'
TaskName|contains: '\Windows\Windows Defender\'
TaskName|contains: '\Windows\WindowsBackup\'
TaskName|contains: '\Windows\WindowsUpdate\'

Stage 2: not 1 of filter_sys_username

SubjectUserName|endswith: '$'
TaskName|contains: '\Windows\Windows Defender\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
SubjectUserNameends_with
  • $ corpus 18 (sigma 14, elastic 4)
TaskNamematch
  • \Windows\BitLocker corpus 2 (sigma 2)
  • \Windows\ExploitGuard corpus 2 (sigma 2)
  • \Windows\SystemRestore\SR corpus 2 (sigma 2)
  • \Windows\UpdateOrchestrator\Schedule
  • \Windows\Windows Defender\ corpus 2 (sigma 2)
  • \Windows\WindowsBackup\ corpus 2 (sigma 2)
  • \Windows\WindowsUpdate\ corpus 2 (sigma 2)

Neighbors

Often fire together

Rules that target events appearing in the same incident timelines. They pattern-match on adjacent steps of the same TTP, so an alert from one is often paired with alerts from these. Useful for triage context and for assembling chained-detection rules.