Deletion of SD Value to Hide Scheduled Task in Registry

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

This rule detects the deletion of the 'SD' (Security Descriptor) value within the `\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\` registry hive. This action is typically performed by adversaries to hide scheduled tasks, making them less visible to standard enumeration tools. This technique has been observed in use by the Tarrask malware.