Detection rules › Sigma
Important Scheduled Task Deleted
Detects when adversaries try to stop system services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Impact | T1489 Service Stop |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| TaskScheduler | 141 | User "TaskName" deleted Task Scheduler task "Name". |
Stages and Predicates
Stage 1: selection
or:
TaskName|contains: '\Windows\BitLocker'
TaskName|contains: '\Windows\ExploitGuard'
TaskName|contains: '\Windows\SystemRestore\SR'
TaskName|contains: '\Windows\UpdateOrchestrator\'
TaskName|contains: '\Windows\Windows Defender\'
TaskName|contains: '\Windows\WindowsBackup\'
TaskName|contains: '\Windows\WindowsUpdate\'
Stage 2: not filter
or:
UserName|contains: AUTHORI
UserName|contains: AUTORI
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
TaskName | match |
|
UserName | match |
|