Query: detect Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order t in logs
Matching passage: Sigma rule: Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order t. Logsource: windows / security. Rule: title: Important Scheduled Task Deleted/Disabled id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad related: - id: dbc1f800-0fe0-4bc0-9c66-292c2abe3f78 type: similar - id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980 type: similar - id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d type: similar status: test description: Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4699 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4701 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-05 modified: 2023-03-13 tags: - attack.execution - attack.privilege-escalation - attack.persistence - attack.t1053.005 logsource: product: windows service: security definition: The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data. detection: selection: EventID: - 4699 - 4701 TaskName|contains: - \Windows\SystemRestore\SR - \Windows\Windows Defender\ - \Windows\BitLocker - \Windows\WindowsBackup\ - \Windows\WindowsUpdate\ - \Windows\UpdateOrchestrator\Schedule - \Windows\ExploitGuard filter_main_defender_update: EventID: 4699 SubjectUserName|endswith: $ TaskName|contains: \Windows\Windows Defender\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable/info.yml simulation: - type: atomic-red-team name: Windows - Disable the SR scheduled task technique: T1490 atomic_guid: 1c68c68d-83a4-4981-974e-8993055fa034
Near-miss passage: Sigma rule: Detects execution of "msdt.exe" using an answer file which is simulating the legitimate way of calling msdt via "pcwrun.. Logsource: windows / process_creation. Rule: title: MSDT Execution Via Answer File id: 9c8c7000-3065-44a8-a555-79bcba5d9955 status: test description: 'Detects execution of "msdt.exe" using an answer file which is simulating the legitimate way of calling msdt via "pcwrun.exe" (For example from the compatibility tab). ' references: - https://lolbas-project.github.io/lolbas/Binaries/Msdt/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-13 modified: 2025-10-29 tags: - attack.stealth - attack.t1218 - attack.execution logsource: category: process_creation product: windows detection: selection: Image|endswith: \msdt.exe CommandLine|contains: \WINDOWS\diagnostics\index\PCWDiagnostic.xml CommandLine|contains|windash: ' -af ' filter_main_pcwrun: ParentImage|endswith: \pcwrun.exe condition: selection and not 1 of filter_main_* falsepositives: - Possible undocumented parents of "msdt" other than "pcwrun". level: high