Important Scheduled Task Deleted/Disabled
Detects when important scheduled tasks are deleted or disabled. Adversaries may delete or disable scheduled tasks to hinder defensive capabilities, stop legitimate services, or prevent forensic analysis. This rule specifically targets tasks related to system restore, Windows Defender, BitLocker, Windows Backup, and Windows Update, which are critical for system integrity and security.
Sigma
