Removal Of Index Value to Hide Schedule Task - Registry

Title: Removal Of Index Value to Hide Schedule Task - Registry
Status: test
Description:Detects when the "index" value of a scheduled task is removed or deleted from the registry. Which effectively hides it from any tooling such as "schtasks /query"
References:
  -https://blog.qualys.com/vulnerabilities-threat-research/2022/06/20/defending-against-scheduled-task-attacks-in-windows-environments
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-26
modified:2025-10-25
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• product: windows
• category: registry_delete

Detection:
  selection:
    TargetObject|contains|all:
      -'\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\'
      -'Index'

  condition:selection
Falsepositives:
  -Unknown
Level: medium