Windows Security: Disabling Scheduled Defrag Task via Event ID 4701

title: "Windows Security: Disabling Scheduled Defrag Task via Event ID 4701"
id: ef892c42-fa6b-4373-b1d9-fd39fedd2297
related:
  - id: 958d81aa-8566-4cea-a565-59ccd4df27b0
    type: derived
  - id: c5a178bf-9cfb-4340-b584-e4df39b6a3e7
    type: derived
status: test
description: This rule identifies Windows Security audit events where the scheduled defragmentation task is modified, specifically matching the task name \\Microsoft\\Windows\\Defrag\\ScheduledDefrag with EventID 4701. Attackers may disable or tamper with scheduled maintenance tasks to reduce system noise or to hinder defensive monitoring and persistence mechanisms. The detection relies on Windows Security auditing of other object access events and the presence of task-related details in EventID 4701.
references:
  - https://securelist.com/apt-slingshot/84312/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/TA/Slingshot/win_security_apt_slingshot.yml
author: Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1), Huntrule Team
date: 2019-03-04
modified: 2022-11-27
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053
  - attack.s0111
  - detection.emerging-threats
logsource:
  product: windows
  service: security
  definition: "Requirements: Audit Policy : Audit Other Object Access Events > Success"
detection:
  selection:
    EventID: 4701
    TaskName: \Microsoft\Windows\Defrag\ScheduledDefrag
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1