Windows schtasks.exe Used to Delete Scheduled Tasks for System and Security Components

Alerts when schtasks.exe runs with /delete targeting sensitive Windows scheduled tasks that support security, updates, or recovery.

FreeUnreviewedSigmahighv1

windows-schtasks-exe-used-to-delete-scheduled-tasks-for-system-and-security-comp-dbc1f800

title: Windows schtasks.exe Used to Delete Scheduled Tasks for System and Security Components
id: cbe591fa-97d0-472a-9a72-0117b45cee47
related:
  - id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d
    type: similar
  - id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad
    type: similar
  - id: dbc1f800-0fe0-4bc0-9c66-292c2abe3f78
    type: derived
status: test
description: This rule flags Windows process creation events where schtasks.exe is executed with the /delete parameter and the command line references scheduled tasks under sensitive Windows paths (e.g., BitLocker, Exploit Guard, System Restore, update/orchestrator, and Windows Defender/backup/update tasks). Deleting scheduled tasks can disrupt defenses and persistence and may be used to enable data destruction or degrade recovery and update mechanisms. It relies on process creation telemetry capturing the executable name (schtasks.exe) and the full command line arguments, including task path patterns.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_delete.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-09
modified: 2026-03-11
tags:
  - attack.impact
  - attack.t1489
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \schtasks.exe
    - OriginalFileName: schtasks.exe
  selection_cli_delete:
    CommandLine|contains|windash: /delete
  selection_cli_task:
    CommandLine|contains:
      - \Windows\BitLocker
      - \Windows\ExploitGuard
      - \Windows\SystemRestore\SR
      - \Windows\UpdateOrchestrator\
      - \Windows\Windows Defender\
      - \Windows\WindowsBackup\
      - \Windows\WindowsUpdate\
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_schtasks_delete/info.yml
license: DRL-1.1

What it detects

This rule flags Windows process creation events where schtasks.exe is executed with the /delete parameter and the command line references scheduled tasks under sensitive Windows paths (e.g., BitLocker, Exploit Guard, System Restore, update/orchestrator, and Windows Defender/backup/update tasks). Deleting scheduled tasks can disrupt defenses and persistence and may be used to enable data destruction or degrade recovery and update mechanisms. It relies on process creation telemetry capturing the executable name (schtasks.exe) and the full command line arguments, including task path patterns.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.