huntrule

Windows schtasks.exe Used to Delete Scheduled Tasks for System and Security Components

Alerts when schtasks.exe runs with /delete targeting sensitive Windows scheduled tasks that support security, updates, or recovery.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-09-09
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Impact

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process creation events where schtasks.exe is executed with the /delete parameter and the command line references scheduled tasks under sensitive Windows paths (e.g., BitLocker, Exploit Guard, System Restore, update/orchestrator, and Windows Defender/backup/update tasks). Deleting scheduled tasks can disrupt defenses and persistence and may be used to enable data destruction or degrade recovery and update mechanisms. It relies on process creation telemetry capturing the executable name (schtasks.exe) and the full command line arguments, including task path patterns.

Reporting behind it

Related detections9 linkedT1489 — drag to rearrange
Possible Akira Ransomware VM Shutdown via vim-cmd
Possible Ransomware Pre-Encryption VM Termination via esxcli
Malicious Massive Processes Termination Burst (via process_creation)
Malicious Service Deactivation - Command (via process_creation)
Malicious ESXi Virtual Machine Termination and Snapshot Removal
Malicious Stopping of Security or Backup Services Before Impact (via process_creation)
Malicious Massive Services Deletion Burst (via process_creation)
Malicious Security Service Tampering via wmic PathName Query (via process_creation)
Suspicious GhostLocker Watchdog Process Execution (via process_creation)
Windows schtasks.exe Used to Delete Scheduled Tasks for System and Security Components
Pivot detection · T1489 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.