Stealthy Deletion of Scheduled Tasks (T1070.004)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•1

Detects the creation and subsequent deletion of a scheduled task within a short timeframe (5 minutes), which can indicate an attacker attempting to cover their tracks after executing a malicious task.