1type: trigger
2name: sigmahq/proc_creation_win_schtasks_delete_all
3description: |
4  Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.
5filter: |
6  (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.Image endsWith '\\schtasks.exe' && evt.Parsed.CommandLine contains ' /delete ' && evt.Parsed.CommandLine contains '/tn *' && evt.Parsed.CommandLine contains ' /f')
7blackhole: 2m
8#status: test
9labels:
10  service: windows
11  confidence: 1
12  spoofable: 0
13  classification:
14   - attack.t1489
15
16  label: "Delete All Scheduled Tasks"
17  behavior : "windows:audit"
18  remediation: false
19
20scope:
21  type: ParentProcessId
22  expression: evt.Parsed.ParentProcessId
23
24