Hayabusa high test sigma

Delete Important Scheduled Task

Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities

View Source

Detection Logic

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection_img": [
    {
      "NewProcessName
| endswith": "\\schtasks.exe"
    },
    {
      "OriginalFileName": "schtasks.exe"
    }
  ],
  "selection_cli_delete": {
    "CommandLine
| contains
| windash": "/delete"
  },
  "selection_cli_task": {
    "CommandLine
| contains": [
      "\\Windows\\BitLocker",
      "\\Windows\\ExploitGuard",
      "\\Windows\\SystemRestore\\SR",
      "\\Windows\\UpdateOrchestrator\\",
      "\\Windows\\Windows Defender\\",
      "\\Windows\\WindowsBackup\\",
      "\\Windows\\WindowsUpdate\\"
    ]
  },
  "condition": "process_creation and (all of selection_*)"
}

False Positives

  • ⚠ Unlikely

Field Validations

Loading…

Comments (0)

Loading comments...