Sigma rule: Scheduled Task Deletion

Rule

Title

Scheduled Task Deletion

Status

test

Level

low

Author

David Strassegger, Tim Shelton

Date

2021-01-22

Modified

2023-01-20

File

rules-threat-hunting/windows/builtin/security/win_security_scheduled_task_deletion.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects scheduled task deletion events. Scheduled tasks are likely to be deleted if not used for persistence. Malicious Software often creates tasks directly under the root node e.g. \TASKNAME

Log source

product

windows

service

security

definition

Requirements: The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data.

Detection

selection:
    EventID: 4699
filter_main_generic:
    TaskName: '\Microsoft\Windows\RemovalTools\MRT_ERROR_HB' # Triggered by ParentCommandLine=C:\WINDOWS\system32\MRT.exe /EHB /HeartbeatFailure ErrorStack,Previous=ErrorStack,Previous=ErrorStack,Previous=ErrorStack,Previous=ErrorStack,Previous=SubmitHeartbeatReportData,Hr=0x80072f8f,Hr=0x80072f8f,Hr=0x80072f8f,Hr=0x80072f8f,Hr=0x80072f8f /HeartbeatError 0x80072f8f
filter_main_firefox:
    TaskName|contains: '\Mozilla\Firefox Default Browser Agent ' # Triggered by firefox updates
condition: selection and not 1 of filter_*

False positives (as the rule lists them)

• Software installation

Tags

• attack.execution
• attack.privilege-escalation
• attack.persistence
• car.2013-08-001
• attack.t1053.005
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1053.005

References

• https://twitter.com/matthewdunwoody/status/1352356685982146562
• https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4699

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/builtin/security/win_security_scheduled_task_deletion.yml