Scheduled Task Deletion — Detection Rule

Detects scheduled task deletion events. Scheduled tasks are likely to be deleted if not used for persistence. Malicious Software often creates tasks directly under the root node e.g. \TASKNAME

Read the full analysis on IntelFusions