Windows schtasks.exe /disable Used to Disable Security-Critical Scheduled Tasks
Flags schtasks.exe executions using /disable against security-critical Windows scheduled task paths.
- Product
- windows
- Category
- process_creation
- Author
- frack113, Nasreddine Bencherchali (Nextron Systems), X__Junior (SigmaHQ), DRL 1.1
- Published
- 2021-12-26
- Updated
- 2026-07-30
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches process creation events where schtasks.exe is executed with a /disable argument. It further restricts matches to task name patterns associated with BitLocker, Exploit Guard, System Restore (SR), Update Orchestrator, Windows Defender, Windows Backup, and Windows Update, which are commonly used for system protection and maintenance. Disabling these tasks can reduce defenses and support attacker actions; the rule relies on process creation telemetry including Image/OriginalFileName and CommandLine content.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-8---windows---disable-the-sr-scheduled-task
- twitter.comhttps://twitter.com/MichalKoczwara/status/1553634816016498688
- thedfirreport.comhttps://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_disable.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows schtasks.exe /disable Used to Disable Security-Critical Scheduled Tasks
id: 1e8a979d-3245-4e16-8741-ba3be5027bbb
related:
- id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad
type: similar
- id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d
type: similar
- id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980
type: derived
status: test
description: This rule matches process creation events where schtasks.exe is executed with a /disable argument. It further restricts matches to task name patterns associated with BitLocker, Exploit Guard, System Restore (SR), Update Orchestrator, Windows Defender, Windows Backup, and Windows Update, which are commonly used for system protection and maintenance. Disabling these tasks can reduce defenses and support attacker actions; the rule relies on process creation telemetry including Image/OriginalFileName and CommandLine content.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-8---windows---disable-the-sr-scheduled-task
- https://twitter.com/MichalKoczwara/status/1553634816016498688
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_disable.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), X__Junior, Huntrule Team
date: 2021-12-26
modified: 2026-03-11
tags:
- attack.impact
- attack.t1489
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \schtasks.exe
- OriginalFileName: schtasks.exe
selection_cli_disable:
CommandLine|contains|windash: /disable
selection_cli_task:
CommandLine|contains:
- \Windows\BitLocker
- \Windows\ExploitGuard
- \Windows\ExploitGuard\ExploitGuard MDM policy Refresh
- \Windows\SystemRestore\SR
- \Windows\UpdateOrchestrator\
- \Windows\Windows Defender\
- \Windows\WindowsBackup\
- \Windows\WindowsUpdate\
condition: all of selection_*
falsepositives:
- Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_schtasks_disable/info.yml
simulation:
- type: atomic-red-team
name: Windows - Disable the SR scheduled task
technique: T1490
atomic_guid: 1c68c68d-83a4-4981-974e-8993055fa034
license: DRL-1.1