Windows Schtasks Deletion/Modification of ScheduledDefrag Task

title: Windows Schtasks Deletion/Modification of ScheduledDefrag Task
id: 07fdd239-d0aa-497c-b4ea-4694603e358d
status: test
description: This rule flags Windows process executions of schtasks.exe that delete or change the Microsoft\Windows\Defrag\ScheduledDefrag task. Disabling scheduled defragmentation can be used to interfere with host maintenance and persistence indicators by modifying or removing a known scheduled task. The detection relies on process creation telemetry, specifically the schtasks.exe command line containing /TN for the Defrag task and /delete and/or /change modifiers.
references:
  - https://securelist.com/apt-slingshot/84312/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/TA/Slingshot/proc_creation_win_apt_slingshot.yml
author: Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1), Huntrule Team
date: 2019-03-04
modified: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.005
  - attack.s0111
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \schtasks.exe
    CommandLine|contains:
      - /delete
      - /change
    CommandLine|contains|all:
      - /TN
      - \Microsoft\Windows\Defrag\ScheduledDefrag
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 958d81aa-8566-4cea-a565-59ccd4df27b0
    type: derived