Windows ScheduledDefrag task removal via schtasks /delete and /change
Detects schtasks.exe commands that delete or change the ScheduledDefrag scheduled task.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1) (SigmaHQ), DRL 1.1
- Published
- 2019-03-04
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows attempts to disable or remove the ScheduledDefrag scheduled task by invoking schtasks.exe with arguments indicating deletion or change of the task name path. Attackers may use task tampering to disrupt persistence mechanisms or alter scheduled execution. The detection relies on process creation telemetry, matching schtasks.exe command-line parameters that reference Microsoft\Windows\Defrag\ScheduledDefrag along with /TN and /delete or /change.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows ScheduledDefrag task removal via schtasks /delete and /change
id: 07fdd239-d0aa-497c-b4ea-4694603e358d
status: test
description: This rule identifies Windows attempts to disable or remove the ScheduledDefrag scheduled task by invoking schtasks.exe with arguments indicating deletion or change of the task name path. Attackers may use task tampering to disrupt persistence mechanisms or alter scheduled execution. The detection relies on process creation telemetry, matching schtasks.exe command-line parameters that reference Microsoft\Windows\Defrag\ScheduledDefrag along with /TN and /delete or /change.
references:
- https://securelist.com/apt-slingshot/84312/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/TA/Slingshot/proc_creation_win_apt_slingshot.yml
author: Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1), Huntrule Team
date: 2019-03-04
modified: 2022-10-09
tags:
- attack.privilege-escalation
- attack.execution
- attack.persistence
- attack.t1053.005
- attack.s0111
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \schtasks.exe
CommandLine|contains:
- /delete
- /change
CommandLine|contains|all:
- /TN
- \Microsoft\Windows\Defrag\ScheduledDefrag
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 958d81aa-8566-4cea-a565-59ccd4df27b0
type: derived