huntrule

Windows Task Scheduler: Detect Scheduled Task Deleted or Disabled for Key System Tasks

Alert on deletion or disabling of targeted Windows scheduled tasks tied to system, security, and update components.

FreeUnreviewedSigmahighv1
title: "Windows Task Scheduler: Detect Scheduled Task Deleted or Disabled for Key System Tasks"
id: 13cf4677-8cae-4b35-a6ee-8243d5fb768a
related:
  - id: dbc1f800-0fe0-4bc0-9c66-292c2abe3f78
    type: similar
  - id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad
    type: similar
  - id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980
    type: similar
  - id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d
    type: derived
status: test
description: This rule flags Windows scheduled task events where a task is deleted (EventID 141) or disabled (EventID 142) and the task name contains specific paths for system and security-related tasks. Attackers may disable or remove these tasks to disrupt automated protections or impact system operations before further malicious activity. The detection relies on Task Scheduler Operational telemetry capturing task deletion/disable events and the task name string in those events.
references:
  - https://www.socinvestigation.com/most-common-windows-event-ids-to-hunt-mind-map/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable.yml
author: frack113, Huntrule Team
date: 2023-01-13
modified: 2026-03-11
tags:
  - attack.impact
  - attack.t1489
logsource:
  product: windows
  service: taskscheduler
  definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger'
detection:
  selection:
    EventID:
      - 141
      - 142
    TaskName|contains:
      - \Windows\SystemRestore\SR
      - \Windows\Windows Defender\
      - \Windows\BitLocker
      - \Windows\WindowsBackup\
      - \Windows\WindowsUpdate\
      - \Windows\UpdateOrchestrator\
      - \Windows\ExploitGuard
  filter_main_user:
    UserName|contains:
      - AUTHORI
      - AUTORI
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable/info.yml
simulation:
  - type: atomic-red-team
    name: Windows - Disable the SR scheduled task
    technique: T1490
    atomic_guid: 1c68c68d-83a4-4981-974e-8993055fa034
license: DRL-1.1

What it detects

This rule flags Windows scheduled task events where a task is deleted (EventID 141) or disabled (EventID 142) and the task name contains specific paths for system and security-related tasks. Attackers may disable or remove these tasks to disrupt automated protections or impact system operations before further malicious activity. The detection relies on Task Scheduler Operational telemetry capturing task deletion/disable events and the task name string in those events.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.