Windows Registry: Delete SD Value Under Schedule\TaskCache\Tree to Impair Scheduled Task Visibility

title: "Windows Registry: Delete SD Value Under Schedule\\TaskCache\\Tree to Impair Scheduled Task Visibility"
id: 211317d2-7618-495b-9749-996954c692ab
related:
  - id: 526cc8bc-1cdc-48ad-8b26-f19bff969cec
    type: similar
  - id: acd74772-5f88-45c7-956b-6a7b36c294d2
    type: derived
status: test
description: This rule flags registry deletions that remove the SD value under the Schedule\TaskCache\Tree path in Windows. Attackers can use this defense-impairment behavior to hide or disrupt scheduled task visibility by altering security descriptor-related data. It relies on telemetry indicating registry value deletion events with a target object path containing the specified Schedule\TaskCache\Tree key and including an SD value.
references:
  - https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_sd_value_removal.yml
author: Sittikorn S, Huntrule Team
date: 2022-04-15
modified: 2025-10-25
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  category: registry_delete
detection:
  selection:
    TargetObject|contains|all:
      - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\
      - SD
  condition: selection
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_sd_value_removal/info.yml
license: DRL-1.1