Windows Security: Detect Scheduled Task Deletion (EventID 4699)
Flags Windows scheduled task deletions from Security EventID 4699 while excluding common MRT and Firefox-related tasks.
- Product
- windows
- Service
- security
- Author
- David Strassegger, Tim Shelton (SigmaHQ), DRL 1.1
- Published
- 2021-01-22
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows Security events where a scheduled task is deleted (EventID 4699), indicating potential removal of persistence mechanisms. Attackers may delete scheduled tasks to erase execution artifacts or disable previously installed persistence. It relies on Advanced Audit Policy logging for other object access events and matches the task deletion event by the recorded task name in the event telemetry.
Reporting behind it
- twitter.comhttps://twitter.com/matthewdunwoody/status/1352356685982146562
- docs.microsoft.comhttps://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4699
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/builtin/security/win_security_scheduled_task_deletion.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Security: Detect Scheduled Task Deletion (EventID 4699)"
id: 6a28f533-0c6b-444f-a43b-1d8642e3a44d
status: test
description: This rule identifies Windows Security events where a scheduled task is deleted (EventID 4699), indicating potential removal of persistence mechanisms. Attackers may delete scheduled tasks to erase execution artifacts or disable previously installed persistence. It relies on Advanced Audit Policy logging for other object access events and matches the task deletion event by the recorded task name in the event telemetry.
references:
- https://twitter.com/matthewdunwoody/status/1352356685982146562
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4699
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/builtin/security/win_security_scheduled_task_deletion.yml
author: David Strassegger, Tim Shelton, Huntrule Team
date: 2021-01-22
modified: 2023-01-20
tags:
- attack.execution
- attack.privilege-escalation
- attack.persistence
- car.2013-08-001
- attack.t1053.005
- detection.threat-hunting
logsource:
product: windows
service: security
definition: "Requirements: The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data."
detection:
selection:
EventID: 4699
filter_main_generic:
TaskName: \Microsoft\Windows\RemovalTools\MRT_ERROR_HB
filter_main_firefox:
TaskName|contains: "\\Mozilla\\Firefox Default Browser Agent "
condition: selection and not 1 of filter_*
falsepositives:
- Software installation
level: low
license: DRL-1.1
related:
- id: 4f86b304-3e02-40e3-aa5d-e88a167c9617
type: derived