huntrule

Windows Task Scheduler: Detects Scheduled Task Deletion or Disabling (Task Deleted/Disabled)

Alert on deletion or disabling of targeted Windows scheduled tasks tied to system, security, and update components.

FreeReviewedSigma · High · v2
Product
windows
Service
taskscheduler
Author
frack113 (SigmaHQ), DRL 1.1
Published
2023-01-13
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Impact

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows scheduled task events where a task is deleted or disabled, focusing on high-value system maintenance and security-related task paths. Attackers often remove or suppress scheduled tasks to disrupt recovery, backups, patching, or security controls and to enable impact activities. It relies on TaskScheduler telemetry for Task Deleted (EventID 141) and Task Disabled (EventID 142) and matches specific task names by substring, excluding matches for usernames containing "AUTHORI" or "AUTORI".

Reporting behind it

Related detections9 linkedT1489 — drag to rearrange
Malicious CrazyHunter Ransomware Toolkit Execution from Public Directory
Suspicious Service Termination via Net Stop Before Ransomware (via process_creation)
Malicious Lynx Ransomware Encryptor Execution via Distinctive CLI Flags (via process_creation)
Malicious Termination of Veeam Backup Services
Possible Akira Ransomware VM Shutdown via vim-cmd
Possible Ransomware Pre-Encryption VM Termination via esxcli
Malicious Massive Processes Termination Burst (via process_creation)
Malicious Service Deactivation - Command (via process_creation)
Malicious ESXi Virtual Machine Termination and Snapshot Removal
Windows Task Scheduler: Detects Scheduled Task Deletion or Disabling (Task Deleted/Disabled)
Pivot detection · T1489 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.