Query: detect Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior c in logs
Matching passage: Sigma rule: Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior c. Logsource: windows / process_creation. Rule: title: Suspicious Scheduled Task Creation via Masqueraded XML File id: dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c status: test description: Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence references: - https://learn.microsoft.com/en-us/windows/win32/taskschd/daily-trigger-example--xml- - https://github.com/elastic/protections-artifacts/blob/084067123d3328a823b1c3fdde305b694275c794/behavior/rules/persistence_suspicious_scheduled_task_creation_via_masqueraded_xml_file.toml author: Swachchhanda Shrawan Poudel, Elastic (idea) date: 2023-04-20 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.stealth - attack.t1036.005 - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_cli_create: CommandLine|contains: - /create - -create selection_cli_xml: CommandLine|contains: - /xml - -xml filter_main_extension_xml: CommandLine|contains: .xml filter_main_system_process: IntegrityLevel: - System - S-1-16-16384 filter_main_rundll32: ParentImage|endswith: \rundll32.exe ParentCommandLine|contains|all: - :\WINDOWS\Installer\MSI - .tmp,zzzzInvokeManagedCustomActionOutOfProc filter_optional_third_party: ParentImage|endswith: - :\ProgramData\OEM\UpgradeTool\CareCenter_*\BUnzip\Setup_msi.exe - :\Program Files\Axis Communications\AXIS Camera Station\SetupActions.exe - :\Program Files\Axis Communications\AXIS Device Manager\AdmSetupActions.exe - :\Program Files (x86)\Zemana\AntiMalware\AntiMalware.exe - :\Program Files\Dell\SupportAssist\pcdrcui.exe condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate upda. Logsource: windows / dns_query. Rule: title: Notepad++ Updater DNS Query to Uncommon Domains id: 2074e137-1b73-4e2d-88ba-5a3407dbdce0 status: experimental description: 'Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate update infrastructure. This could indicate potential exploitation of the updater mechanism or suspicious network activity that warrants further investigation. ' references: - https://notepad-plus-plus.org/news/v889-released/ - https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/ - https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/ - https://securelist.com/notepad-supply-chain-attack/118708/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-02-02 modified: 2026-03-16 tags: - attack.collection - attack.credential-access - attack.t1195.002 - attack.initial-access - attack.t1557 logsource: category: dns_query product: windows detection: selection: Image|endswith: \gup.exe filter_main_notepad_legit_domain: QueryName: notepad-plus-plus.org filter_optional_sourceforge_legit_domain: QueryName|endswith: .sourceforge.net filter_optional_github_legit_domain: - QueryName|endswith: .githubusercontent.com - QueryName: github.com filter_optional_google_storage_legit_domain: QueryName|endswith: .googleapis.com filter_optional_uncommon_domains: QueryName|endswith: - .azurewebsites.net - block.opendns.com - gateway.zscalerthree.net condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Some legitimate network misconfigurations or proxy issues causing unexpected DNS queries. - Other legitimate query to official domains not listed in the filter, needing tuning. level: medium