huntrule

Windows schtasks.exe /disable Used to Disable Security-Critical Scheduled Tasks

Flags schtasks.exe executions using /disable against security-critical Windows scheduled task paths.

FreeUnreviewedSigmahighv1
title: Windows schtasks.exe /disable Used to Disable Security-Critical Scheduled Tasks
id: 1e8a979d-3245-4e16-8741-ba3be5027bbb
related:
  - id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad
    type: similar
  - id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d
    type: similar
  - id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980
    type: derived
status: test
description: This rule matches process creation events where schtasks.exe is executed with a /disable argument. It further restricts matches to task name patterns associated with BitLocker, Exploit Guard, System Restore (SR), Update Orchestrator, Windows Defender, Windows Backup, and Windows Update, which are commonly used for system protection and maintenance. Disabling these tasks can reduce defenses and support attacker actions; the rule relies on process creation telemetry including Image/OriginalFileName and CommandLine content.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-8---windows---disable-the-sr-scheduled-task
  - https://twitter.com/MichalKoczwara/status/1553634816016498688
  - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_disable.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), X__Junior, Huntrule Team
date: 2021-12-26
modified: 2026-03-11
tags:
  - attack.impact
  - attack.t1489
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \schtasks.exe
    - OriginalFileName: schtasks.exe
  selection_cli_disable:
    CommandLine|contains|windash: /disable
  selection_cli_task:
    CommandLine|contains:
      - \Windows\BitLocker
      - \Windows\ExploitGuard
      - \Windows\ExploitGuard\ExploitGuard MDM policy Refresh
      - \Windows\SystemRestore\SR
      - \Windows\UpdateOrchestrator\
      - \Windows\Windows Defender\
      - \Windows\WindowsBackup\
      - \Windows\WindowsUpdate\
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_schtasks_disable/info.yml
simulation:
  - type: atomic-red-team
    name: Windows - Disable the SR scheduled task
    technique: T1490
    atomic_guid: 1c68c68d-83a4-4981-974e-8993055fa034
license: DRL-1.1

What it detects

This rule matches process creation events where schtasks.exe is executed with a /disable argument. It further restricts matches to task name patterns associated with BitLocker, Exploit Guard, System Restore (SR), Update Orchestrator, Windows Defender, Windows Backup, and Windows Update, which are commonly used for system protection and maintenance. Disabling these tasks can reduce defenses and support attacker actions; the rule relies on process creation telemetry including Image/OriginalFileName and CommandLine content.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.