Disable Important Scheduled Task

Date: 08/27/2024

Severity: High

Summary

Detects when adversaries halt services or processes by disabling their scheduled tasks to carry out data-destructive actions.

Indicators of Compromise (IOC) List

Image

'\schtasks.exe'

CommandLine

'/Change'

'/TN'

'/disable'

'\Windows\BitLocker'

'\Windows\ExploitGuard'

'\Windows\ExploitGuard\ExploitGuard MDM policy Refresh'

'\Windows\SystemRestore\SR'

'\Windows\UpdateOrchestrator\'

'\Windows\Windows Defender\'

'\Windows\WindowsBackup\'

'\Windows\WindowsUpdate\'

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Detection Query 1

((resourceName = "Sysmon" AND eventtype = "1" ) AND image = "\\schtasks.exe" ) AND commandline In ("//Change" , "//TN" , "/disable" , "\\Windows\\BitLocker" , "\\Windows\\ExploitGuard" , "\\Windows\\ExploitGuard\\ExploitGuard MDM policy Refresh" , "\\Windows\\SystemRestore\\SR" , "\\Windows\\UpdateOrchestrator" , "\\Windows\\Windows Defender" , "\\Windows\\WindowsBackup" , "\\Windows\\WindowsUpdate" )

Detection Query 2

((Technologygroup = "EDR" ) AND image = "\\schtasks.exe" ) AND commandline In ("//Change" , "//TN" , "/disable" , "\\Windows\\BitLocker" , "\\Windows\\ExploitGuard" , "\\Windows\\ExploitGuard\\ExploitGuard MDM policy Refresh" , "\\Windows\\SystemRestore\\SR" , "\\Windows\\UpdateOrchestrator" , "\\Windows\\Windows Defender" , "\\Windows\\WindowsBackup" , "\\Windows\\WindowsUpdate" )

Reference:

Sigma Detection Rule for Disabling Scheduled Tasks

Atomic Red Team Test for Disabling the System Restore Scheduled Task

Michal Koczwara's Post on Scheduled Task Disabling

The DFIR Report Analysis of IcedID to XingLocker Ransomware in 24 Hours