Defrag Deactivation

 1title: Defrag Deactivation
 2id: 958d81aa-8566-4cea-a565-59ccd4df27b0
 3status: test
 4description: Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group
 5references:
 6    - https://securelist.com/apt-slingshot/84312/
 7author: Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1)
 8date: 2019-03-04
 9modified: 2022-10-09
10tags:
11    - attack.persistence
12    - attack.t1053.005
13    - attack.s0111
14    - detection.emerging-threats
15logsource:
16    category: process_creation
17    product: windows
18detection:
19    selection:
20        Image|endswith: '\schtasks.exe'
21        CommandLine|contains:
22            - '/delete'
23            - '/change'
24        CommandLine|contains|all:
25            - '/TN'
26            - '\Microsoft\Windows\Defrag\ScheduledDefrag'
27    condition: selection
28falsepositives:
29    - Unknown
30level: medium

References

• The Slingshot APT FAQ

  

  While analyzing some memory dumps suspicious of being infected with a keylogger, we identified a library containing strings to interact with a virtual file system. This turned out to be a malicious loader internally named “Slingshot”.

  
  Read More

Related rules

• OilRig APT Activity
• OilRig APT Registry Persistence
• OilRig APT Schedule Task Persistence - Security
• OilRig APT Schedule Task Persistence - System
• Defrag Deactivation - Security