Defrag Deactivation

calendar Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.s0111 detection.emerging-threats  ·
Share on: linkedin copy

Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

Sigma rule (View on GitHub)

 1title: Defrag Deactivation
 2id: 958d81aa-8566-4cea-a565-59ccd4df27b0
 3status: test
 4description: Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group
 5references:
 6    - https://securelist.com/apt-slingshot/84312/
 7author: Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1)
 8date: 2019-03-04
 9modified: 2022-10-09
10tags:
11    - attack.privilege-escalation
12    - attack.execution
13    - attack.persistence
14    - attack.t1053.005
15    - attack.s0111
16    - detection.emerging-threats
17logsource:
18    category: process_creation
19    product: windows
20detection:
21    selection:
22        Image|endswith: '\schtasks.exe'
23        CommandLine|contains:
24            - '/delete'
25            - '/change'
26        CommandLine|contains|all:
27            - '/TN'
28            - '\Microsoft\Windows\Defrag\ScheduledDefrag'
29    condition: selection
30falsepositives:
31    - Unknown
32level: medium

References

  • The Slingshot APT FAQ

    While analyzing some memory dumps suspicious of being infected with a keylogger, we identified a library containing strings to interact with a virtual file system. This turned out to be a malicious loader internally named “Slingshot”.


    Read More

Related rules

to-top