Hide Scheduled Task Via Index Value Tamper

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

Detects when the "Index" value of a scheduled task is modified in the registry to "DWORD (0x00000000)". This modification effectively hides the scheduled task from standard tooling like "schtasks /query", making it harder for defenders to discover.