Windows Security: ScheduledDefrag Task Deactivated via Event ID 4701
Flags Windows EventID 4701 activity that disables the ScheduledDefrag scheduled task.
- Product
- windows
- Service
- security
- Author
- Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1) (SigmaHQ), DRL 1.1
- Published
- 2019-03-04
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies when Windows deactivates the scheduled defragmentation task by matching Security log Event ID 4701 with TaskName set to \\Microsoft\\Windows\\Defrag\\ScheduledDefrag. Disabling scheduled maintenance can be used to reduce system stability monitoring or hinder defensive processes, making it a useful persistence-adjacent signal. It relies on Windows Security auditing for other object access events that record the task deactivation operation.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Security: ScheduledDefrag Task Deactivated via Event ID 4701"
id: ef892c42-fa6b-4373-b1d9-fd39fedd2297
related:
- id: 958d81aa-8566-4cea-a565-59ccd4df27b0
type: derived
- id: c5a178bf-9cfb-4340-b584-e4df39b6a3e7
type: derived
status: test
description: This rule identifies when Windows deactivates the scheduled defragmentation task by matching Security log Event ID 4701 with TaskName set to \\Microsoft\\Windows\\Defrag\\ScheduledDefrag. Disabling scheduled maintenance can be used to reduce system stability monitoring or hinder defensive processes, making it a useful persistence-adjacent signal. It relies on Windows Security auditing for other object access events that record the task deactivation operation.
references:
- https://securelist.com/apt-slingshot/84312/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/TA/Slingshot/win_security_apt_slingshot.yml
author: Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1), Huntrule Team
date: 2019-03-04
modified: 2022-11-27
tags:
- attack.privilege-escalation
- attack.execution
- attack.persistence
- attack.t1053
- attack.s0111
- detection.emerging-threats
logsource:
product: windows
service: security
definition: "Requirements: Audit Policy : Audit Other Object Access Events > Success"
detection:
selection:
EventID: 4701
TaskName: \Microsoft\Windows\Defrag\ScheduledDefrag
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1