Defrag Deactivation via Schtasks

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•20

Detects the deactivation and disabling of the Scheduled defragmentation task using 'schtasks.exe /delete' or 'schtasks.exe /change' commands, specifically targeting the '\Microsoft\Windows\Defrag\ScheduledDefrag' task. This activity has been observed in campaigns by the Slingshot APT group.