Disable Important Scheduled Task

Title: Disable Important Scheduled Task
Status: test
Description:Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-8---windows---disable-the-sr-scheduled-task
  -https://twitter.com/MichalKoczwara/status/1553634816016498688
  -https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
Author: frack113, Nasreddine Bencherchali (Nextron Systems), X__Junior
Date: 2021-12-26
modified:2026-03-11
Tags:

• -'attack.impact'
• -'attack.t1489'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\schtasks.exe' OriginalFileName:'schtasks.exe'   selection_cli_disable:
    CommandLine|contains|windash: '/disable'
  selection_cli_task:
    CommandLine|contains:
      -'\Windows\BitLocker'
      -'\Windows\ExploitGuard'
      -'\Windows\ExploitGuard\ExploitGuard MDM policy Refresh'
      -'\Windows\SystemRestore\SR'
      -'\Windows\UpdateOrchestrator\'
      -'\Windows\Windows Defender\'
      -'\Windows\WindowsBackup\'
      -'\Windows\WindowsUpdate\'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high