huntrule

Windows Security: ScheduledDefrag Task Deactivated via Event ID 4701

Flags Windows EventID 4701 activity that disables the ScheduledDefrag scheduled task.

FreeReviewedSigma · Medium · v5
Product
windows
Service
security
Author
Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1) (SigmaHQ), DRL 1.1
Published
2019-03-04
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies when Windows deactivates the scheduled defragmentation task by matching Security log Event ID 4701 with TaskName set to \\Microsoft\\Windows\\Defrag\\ScheduledDefrag. Disabling scheduled maintenance can be used to reduce system stability monitoring or hinder defensive processes, making it a useful persistence-adjacent signal. It relies on Windows Security auditing for other object access events that record the task deactivation operation.

Reporting behind it

Related detections9 linkedT1053 — drag to rearrange
Malicious Axios npm Compromise Windows Payload Artifacts wt.exe and 6202033 (via process_creation)
Windows: SharPersist Execution via Process Image and Scheduled Task/Startup/Registry/Service Command Lines
Windows process creation: CrackMapExec execution via characteristic command-line flags
Windows Process Creation: Scheduled Task Creation via schtasks and wscript/vbscript
Windows ATSvc Remote RPC Scheduled Task Creation or Execution (RPC Firewall)
Remote ITaskSchedulerService RPC Create/Execute Scheduled Tasks Used for Lateral Movement
RPC Firewall Alerts for Remote Scheduled Task Creation/Execution via SASec
Windows Suspicious Scheduled Task File Write Targeting System32 Tasks
Windows Registry: New TaskCache entry created by unusual process image
Windows Security: ScheduledDefrag Task Deactivated via Event ID 4701
Pivot detection · T1053 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.