Windows Security Event: Scheduled Task Deleted or Disabled (Important Task Names)

title: "Windows Security Event: Scheduled Task Deleted or Disabled (Important Task Names)"
id: 82259097-2340-414b-9231-8df1a64622b1
related:
  - id: dbc1f800-0fe0-4bc0-9c66-292c2abe3f78
    type: similar
  - id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980
    type: similar
  - id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d
    type: similar
  - id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad
    type: derived
status: test
description: This rule flags Windows Security Audit events for scheduled task deletion (Event ID 4699) or disabling (Event ID 4701) when the TaskName contains common high-value task paths (e.g., SystemRestore, Windows Defender, BitLocker, backup/update tasks). Attackers may tamper with scheduled tasks to interrupt security controls, persistence mechanisms, or recovery/backup behaviors before data-destructive activity. It relies on Windows Security log telemetry that includes Event ID, TaskName, and SubjectUserName, with a specific suppression for Defender task changes during machine account (ends with '$') related to upgrades.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4699
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4701
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-05
modified: 2023-03-13
tags:
  - attack.execution
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1053.005
logsource:
  product: windows
  service: security
  definition: The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data.
detection:
  selection:
    EventID:
      - 4699
      - 4701
    TaskName|contains:
      - \Windows\SystemRestore\SR
      - \Windows\Windows Defender\
      - \Windows\BitLocker
      - \Windows\WindowsBackup\
      - \Windows\WindowsUpdate\
      - \Windows\UpdateOrchestrator\Schedule
      - \Windows\ExploitGuard
  filter_main_defender_update:
    EventID: 4699
    SubjectUserName|endswith: $
    TaskName|contains: \Windows\Windows Defender\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable/info.yml
simulation:
  - type: atomic-red-team
    name: Windows - Disable the SR scheduled task
    technique: T1490
    atomic_guid: 1c68c68d-83a4-4981-974e-8993055fa034
license: DRL-1.1