huntrule

Windows ScheduledDefrag task removal via schtasks /delete and /change

Detects schtasks.exe commands that delete or change the ScheduledDefrag scheduled task.

FreeReviewedSigma · Medium · v5
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1) (SigmaHQ), DRL 1.1
Published
2019-03-04
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies Windows attempts to disable or remove the ScheduledDefrag scheduled task by invoking schtasks.exe with arguments indicating deletion or change of the task name path. Attackers may use task tampering to disrupt persistence mechanisms or alter scheduled execution. The detection relies on process creation telemetry, matching schtasks.exe command-line parameters that reference Microsoft\Windows\Defrag\ScheduledDefrag along with /TN and /delete or /change.

Reporting behind it

Related detections9 linkedT1053.005 — drag to rearrange
Suspicious Scheduled Task Creation Referencing dllFake Batch Scripts (via process_creation)
Suspicious Scheduled Task Creation With WebDAV Loader Task Names (via process_creation)
Suspicious Scheduled Task Creation with ClickFix Update Recon Name (via process_creation)
Malicious Scheduled Task Named Gentlemen via Schtasks
Malicious Scheduled Task Masquerading as Defender NisSrv via Schtasks
Malicious Scheduled Task Masquerading as Windows Defender Updater (via process_creation)
Suspicious Scheduled Task Masquerading as Palo Alto Cortex Services
Malicious Scheduled Task Running rundll32 w32analytics (via process_creation)
Malicious Scheduled rundll32 Execution of ProgramData VMware DLL by BianLian
Windows ScheduledDefrag task removal via schtasks /delete and /change
Pivot detection · T1053.005 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.