Scheduled task self deleted
The SAME scheduled task is registered and then deleted within a short window (Security 4698 then 4699 for one task name).
What it detects
The SAME scheduled task is registered and then deleted within a short window (Security 4698 then 4699 for one task name). Create-run-delete is a well-known evasion: a task is dropped to execute a payload or establish a foothold, then removed to erase the persistence artefact before an analyst looks. A lone task creation is routine (see windows.persistence.scheduled_task_created); the create-then-delete ORDERING of one task is the behavioural signal. This is the ordered-sequence realisation of a catalogued behaviour.
MITRE ATT&CK mapping
False positives and triage
Installers and updaters that register a temporary task and clean it up on completion look identical. Confirm the task's action (what it ran), the creating account, and whether the create/delete pair was an authorised software operation. Treat a short-lived task created by a non-standard account, or one whose action launched a shell/encoded command, as high priority.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/windows/scheduled_task_self_deleted.yaml, licensed under the Apache License 2.0.
id: windows.persistence.scheduled_task_self_deleted
version: 1.0.0
status: stable
severity: high
confidence: 0.7
platforms: [windows]
mitre_techniques: [T1053.005, T1070]
description: |
The SAME scheduled task is registered and then deleted within a short window (Security
4698 then 4699 for one task name). Create-run-delete is a well-known evasion: a task is
dropped to execute a payload or establish a foothold, then removed to erase the
persistence artefact before an analyst looks. A lone task creation is routine (see
windows.persistence.scheduled_task_created); the create-then-delete ORDERING of one task
is the behavioural signal. This is the ordered-sequence realisation of behavioural catalog
BEH-080 (ADR-023 Phase B correlation).
sequence:
within_seconds: 900
group_by: [scheduled_task_name]
order: strict
steps:
- id: task_created
match:
event_category: scheduled_task
event_action: task_created
- id: task_deleted
match:
event_category: scheduled_task
event_action: task_deleted
correlation_keys: [scheduled_task_name]
false_positive_guidance: |
Installers and updaters that register a temporary task and clean it up on completion look
identical. Confirm the task's action (what it ran), the creating account, and whether the
create/delete pair was an authorised software operation. Treat a short-lived task created
by a non-standard account, or one whose action launched a shell/encoded command, as high
priority.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.