Defrag Deactivation

calendar Jun 20, 2023 · attack.persistence attack.t1053.005 attack.s0111 detection.emerging_threats  ·
Share on: linkedin copy

Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

Sigma rule (View on GitHub)

 1title: Defrag Deactivation
 2id: 958d81aa-8566-4cea-a565-59ccd4df27b0
 3status: test
 4description: Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group
 5references:
 6    - https://securelist.com/apt-slingshot/84312/
 7author: Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1)
 8date: 2019/03/04
 9modified: 2022/10/09
10tags:
11    - attack.persistence
12    - attack.t1053.005
13    - attack.s0111
14    - detection.emerging_threats
15logsource:
16    category: process_creation
17    product: windows
18detection:
19    selection:
20        Image|endswith: '\schtasks.exe'
21        CommandLine|contains:
22            - '/delete'
23            - '/change'
24        CommandLine|contains|all:
25            - '/TN'
26            - '\Microsoft\Windows\Defrag\ScheduledDefrag'
27    condition: selection
28falsepositives:
29    - Unknown
30level: medium

References

  • The Slingshot APT FAQ

    While analyzing some memory dumps suspicious of being infected with a keylogger, we identified a library containing strings to interact with a virtual file system. This turned out to be a malicious loader internally named “Slingshot”.


    Read More

Related rules

to-top