Scheduled Task Deletion

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•27

Detects scheduled task deletion events. Scheduled tasks are likely to be deleted if not used for persistence. Malicious Software often creates tasks directly under the root node e.g. \TASKNAME