{"id":"220457c1-1c9f-4c2e-afe6-9598926222c1","title":"Delete All Scheduled Tasks","description":"Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-09-09","modified":"","tags":["attack.impact","attack.t1489"],"technique_ids":["T1489"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely"],"references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-delete"],"source_path":"rules/windows/process_creation/proc_creation_win_schtasks_delete_all.yml","source_sha256":"d86d4788a1273dccc4fa498a532badfd88608e7ec1b1544fd221c05ee728e4af","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_schtasks_delete_all.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Delete All Scheduled Tasks\nid: 220457c1-1c9f-4c2e-afe6-9598926222c1\nstatus: test\ndescription: Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.\nreferences:\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-delete\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-09-09\ntags:\n    - attack.impact\n    - attack.t1489\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\schtasks.exe'\n        CommandLine|contains|all:\n            - ' /delete '\n            - '/tn \\*'\n            - ' /f'\n    condition: selection\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1489","id":"T1489","name":"Service Stop","page":"techniques/enterprise/T1489/"}],"data_path":"data/detection-rules/220457c1-1c9f-4c2e-afe6-9598926222c1.json","kind":"sigma"}