Windows Task Scheduler: Detects Scheduled Task Deletion or Disabling (Task Deleted/Disabled)

Alert on deletion or disabling of targeted Windows scheduled tasks tied to system, security, and update components.

FreeReviewedSigma · High · v2

Product: windows
Service: taskscheduler
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2023-01-13
Updated: 2026-07-31

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1489Service Stop

What it detects

This rule flags Windows scheduled task events where a task is deleted or disabled, focusing on high-value system maintenance and security-related task paths. Attackers often remove or suppress scheduled tasks to disrupt recovery, backups, patching, or security controls and to enable impact activities. It relies on TaskScheduler telemetry for Task Deleted (EventID 141) and Task Disabled (EventID 142) and matches specific task names by substring, excluding matches for usernames containing "AUTHORI" or "AUTORI".

Reporting behind it

Related detections9 linkedT1489 — drag to rearrange

Possible Akira Ransomware VM Shutdown via vim-cmd

Possible Ransomware Pre-Encryption VM Termination via esxcli

Malicious Massive Processes Termination Burst (via process_creation)

Malicious Service Deactivation - Command (via process_creation)

Malicious ESXi Virtual Machine Termination and Snapshot Removal

Malicious Stopping of Security or Backup Services Before Impact (via process_creation)

Malicious Massive Services Deletion Burst (via process_creation)

Malicious Security Service Tampering via wmic PathName Query (via process_creation)

Suspicious GhostLocker Watchdog Process Execution (via process_creation)

Windows Task Scheduler: Detects Scheduled Task Deletion or Disabling (Task Deleted/Disabled)

Pivot detection · T1489 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-task-scheduler-detect-scheduled-task-deleted-or-disabled-for-key-system--9e3cb244

title: "Windows Task Scheduler: Detects Scheduled Task Deletion or Disabling (Task Deleted/Disabled)"
id: 13cf4677-8cae-4b35-a6ee-8243d5fb768a
related:
  - id: dbc1f800-0fe0-4bc0-9c66-292c2abe3f78
    type: similar
  - id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad
    type: similar
  - id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980
    type: similar
  - id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d
    type: derived
status: test
description: This rule flags Windows scheduled task events where a task is deleted or disabled, focusing on high-value system maintenance and security-related task paths. Attackers often remove or suppress scheduled tasks to disrupt recovery, backups, patching, or security controls and to enable impact activities. It relies on TaskScheduler telemetry for Task Deleted (EventID 141) and Task Disabled (EventID 142) and matches specific task names by substring, excluding matches for usernames containing "AUTHORI" or "AUTORI".
references:
  - https://www.socinvestigation.com/most-common-windows-event-ids-to-hunt-mind-map/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable.yml
author: frack113, Huntrule Team
date: 2023-01-13
modified: 2026-03-11
tags:
  - attack.impact
  - attack.t1489
logsource:
  product: windows
  service: taskscheduler
  definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger'
detection:
  selection:
    EventID:
      - 141
      - 142
    TaskName|contains:
      - \Windows\SystemRestore\SR
      - \Windows\Windows Defender\
      - \Windows\BitLocker
      - \Windows\WindowsBackup\
      - \Windows\WindowsUpdate\
      - \Windows\UpdateOrchestrator\
      - \Windows\ExploitGuard
  filter_main_user:
    UserName|contains:
      - AUTHORI
      - AUTORI
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable/info.yml
simulation:
  - type: atomic-red-team
    name: Windows - Disable the SR scheduled task
    technique: T1490
    atomic_guid: 1c68c68d-83a4-4981-974e-8993055fa034
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL