Hide Schedule Task Via Index Value Tamper

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•3

Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique)