huntrule

Windows Task Scheduler: Detects Scheduled Task Deletion or Disabling (Task Deleted/Disabled)

Alert on deletion or disabling of targeted Windows scheduled tasks tied to system, security, and update components.

FreeReviewedSigma · High · v2
Product
windows
Service
taskscheduler
Author
frack113 (SigmaHQ), DRL 1.1
Published
2023-01-13
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Impact

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows scheduled task events where a task is deleted or disabled, focusing on high-value system maintenance and security-related task paths. Attackers often remove or suppress scheduled tasks to disrupt recovery, backups, patching, or security controls and to enable impact activities. It relies on TaskScheduler telemetry for Task Deleted (EventID 141) and Task Disabled (EventID 142) and matches specific task names by substring, excluding matches for usernames containing "AUTHORI" or "AUTORI".

Reporting behind it

Related detections9 linkedT1489 — drag to rearrange
Possible Akira Ransomware VM Shutdown via vim-cmd
Possible Ransomware Pre-Encryption VM Termination via esxcli
Malicious Massive Processes Termination Burst (via process_creation)
Malicious Service Deactivation - Command (via process_creation)
Malicious ESXi Virtual Machine Termination and Snapshot Removal
Malicious Stopping of Security or Backup Services Before Impact (via process_creation)
Malicious Massive Services Deletion Burst (via process_creation)
Malicious Security Service Tampering via wmic PathName Query (via process_creation)
Suspicious GhostLocker Watchdog Process Execution (via process_creation)
Windows Task Scheduler: Detects Scheduled Task Deletion or Disabling (Task Deleted/Disabled)
Pivot detection · T1489 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.