defrag
Locates and consolidates fragmented files on local volumes to improve system performance. Windows commands reference
On Windows 1 Sigma rule name it File defrag.exe
Windows
Locates and consolidates fragmented files on local volumes to improve system performance. Membership in the local Administrators group, or equivalent, is the minimum required to run this command.
defrag <volumes> | /c | /e <volumes> [/h] [/m [n]| [/u] [v]]defrag <volumes> | /c | /e <volumes> /a [/h] [/m [n]| [/u] [v]]defrag <volumes> | /c | /e <volumes> /x [/h] [/m [n]| [/u] [v]]defrag <volume> [<parameters>]To defragment the volume on drive C while providing progress and verbose output, type
defrag c: /u /vIdentify/uPrints the progress of the operation on the screen. Windows commands reference/vPrints verbose output containing the fragmentation statistics. Windows commands referenceTo defragment the volumes on drives C and D in parallel in the background, type
defrag c: d: /mIdentify/mRuns the operation on each volume in parallel in the background. Windows commands referenceTo perform a fragmentation analysis of a volume mounted on drive C and provide progress, type
defrag c: mountpoint /a /uIdentify/aPerforms an analysis on the specified volumes. Windows commands reference/uPrints the progress of the operation on the screen. Windows commands referenceTo defragment all volumes with normal priority and provide verbose output, type
defrag /c /h /vIdentify/cPerforms the operation on all volumes. Windows commands reference/hRuns the operation at normal priority (default is low). Windows commands reference/vPrints verbose output containing the fragmentation statistics. Windows commands referenceShow 18 options
<volume>Specifies the drive letter or mount point path of the volume to be defragmented or analyzed./aPerforms an analysis on the specified volumes./bPerforms boot optimization to increase boot performance./cPerforms the operation on all volumes./dPerforms traditional defrag (this is the default). On a tiered volume though, traditional defrag is performed only on the Capacity tier./ePerforms the operation on all volumes except those specified./gOptimizes the storage tiers on the specified volumes./hRuns the operation at normal priority (default is low)./i [n]Tier optimization would run for at most n seconds on each volume./kPerforms slab consolidation on the specified volumes./lPerforms retrim on the specified volumes./m [n]Runs the operation on each volume in parallel in the background. At most, n threads optimize the storage tiers in parallel./oPerforms the proper optimization for each media type./tTracks an operation already in progress on the specified volume./uPrints the progress of the operation on the screen./vPrints verbose output containing the fragmentation statistics./xPerforms free space consolidation on the specified volumes./?Displays the help information.What detects it
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)