Windows Security Event 4699 Scheduled Task Deletion Detection

title: Windows Security Event 4699 Scheduled Task Deletion Detection
id: 6a28f533-0c6b-444f-a43b-1d8642e3a44d
status: test
description: This rule identifies scheduled task deletion using Windows Security auditing (EventID 4699). Attackers may remove existing scheduled tasks to disrupt persistence, cover tracks, or clean up tasks created earlier. It relies on Security log events that indicate a task deletion and optionally excludes specific known task names associated with Microsoft MRT and Firefox update activities.
references:
  - https://twitter.com/matthewdunwoody/status/1352356685982146562
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4699
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/builtin/security/win_security_scheduled_task_deletion.yml
author: David Strassegger, Tim Shelton, Huntrule Team
date: 2021-01-22
modified: 2023-01-20
tags:
  - attack.execution
  - attack.privilege-escalation
  - attack.persistence
  - car.2013-08-001
  - attack.t1053.005
  - detection.threat-hunting
logsource:
  product: windows
  service: security
  definition: "Requirements: The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data."
detection:
  selection:
    EventID: 4699
  filter_main_generic:
    TaskName: \Microsoft\Windows\RemovalTools\MRT_ERROR_HB
  filter_main_firefox:
    TaskName|contains: "\\Mozilla\\Firefox Default Browser Agent "
  condition: selection and not 1 of filter_*
falsepositives:
  - Software installation
level: low
license: DRL-1.1
related:
  - id: 4f86b304-3e02-40e3-aa5d-e88a167c9617
    type: derived