Windows Registry: Scheduled Task Index Value Removal to Hide Task (TaskCache)

title: "Windows Registry: Scheduled Task Index Value Removal to Hide Task (TaskCache)"
id: 9d79ea9b-5a70-40dd-9635-bc8e9aaff50b
related:
  - id: acd74772-5f88-45c7-956b-6a7b36c294d2
    type: similar
  - id: 5b16df71-8615-4f7f-ac9b-6c43c0509e61
    type: similar
  - id: 526cc8bc-1cdc-48ad-8b26-f19bff969cec
    type: derived
status: test
description: This rule flags registry delete events where the 'Index' value under the Scheduled Tasks TaskCache Tree key is removed. Removing this index can impair visibility by tools that enumerate scheduled tasks, helping attackers obscure persisted tasks. It relies on Windows registry deletion telemetry for TargetObject paths containing the TaskCache Tree location and the value name 'Index'.
references:
  - https://blog.qualys.com/vulnerabilities-threat-research/2022/06/20/defending-against-scheduled-task-attacks-in-windows-environments
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_index_value_removal.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-26
modified: 2025-10-25
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  category: registry_delete
detection:
  selection:
    TargetObject|contains|all:
      - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\
      - Index
  condition: selection
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_index_value_removal/info.yml
license: DRL-1.1