Defragmentation Task Deactivation by APT

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•25

Detects the deactivation or disabling of the Windows Scheduled Defragmentation task, which has been observed as a tactic used by the Slingshot APT group to hinder forensic analysis or system maintenance.