Removal of Scheduled Task Index Value from Registry

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects when the "Index" value of a scheduled task is removed or deleted from the Windows Registry. This action effectively hides the scheduled task from standard tooling like "schtasks /query", making it a defense evasion technique.