Delete All Scheduled Tasks — Detection Rule

Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.

Read the full analysis on IntelFusions