Hide Schedule Task Via Index Value Tamper (5b16df71-8615-4f7f-ac9b-6c43c0509e61)
Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique)
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Disable or Modify Tools - T1685 (bbde9781-60aa-4b8a-a911-895b0c1b3872) | Attack Pattern | Hide Schedule Task Via Index Value Tamper (5b16df71-8615-4f7f-ac9b-6c43c0509e61) | Sigma-Rules | 1 |