Query: alert when Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior c
Matching passage: Sigma rule: Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior c. Logsource: windows / process_creation. Rule: title: Suspicious Scheduled Task Creation via Masqueraded XML File id: dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c status: test description: Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence references: - https://learn.microsoft.com/en-us/windows/win32/taskschd/daily-trigger-example--xml- - https://github.com/elastic/protections-artifacts/blob/084067123d3328a823b1c3fdde305b694275c794/behavior/rules/persistence_suspicious_scheduled_task_creation_via_masqueraded_xml_file.toml author: Swachchhanda Shrawan Poudel, Elastic (idea) date: 2023-04-20 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.stealth - attack.t1036.005 - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_cli_create: CommandLine|contains: - /create - -create selection_cli_xml: CommandLine|contains: - /xml - -xml filter_main_extension_xml: CommandLine|contains: .xml filter_main_system_process: IntegrityLevel: - System - S-1-16-16384 filter_main_rundll32: ParentImage|endswith: \rundll32.exe ParentCommandLine|contains|all: - :\WINDOWS\Installer\MSI - .tmp,zzzzInvokeManagedCustomActionOutOfProc filter_optional_third_party: ParentImage|endswith: - :\ProgramData\OEM\UpgradeTool\CareCenter_*\BUnzip\Setup_msi.exe - :\Program Files\Axis Communications\AXIS Camera Station\SetupActions.exe - :\Program Files\Axis Communications\AXIS Device Manager\AdmSetupActions.exe - :\Program Files (x86)\Zemana\AntiMalware\AntiMalware.exe - :\Program Files\Dell\SupportAssist\pcdrcui.exe condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of the Kernel Driver Utility (KDU) tool. KDU can be used to bypass driver signature enforcement and lo. Logsource: windows / process_creation. Rule: title: PUA - Kernel Driver Utility (KDU) Execution id: e76ca062-4de0-4d79-8d90-160a0d335eca status: experimental description: 'Detects execution of the Kernel Driver Utility (KDU) tool. KDU can be used to bypass driver signature enforcement and load unsigned or malicious drivers into the Windows kernel. Potentially allowing for privilege escalation, persistence, or evasion of security controls. ' references: - https://github.com/h4rmy/KDU - https://huntress.com/blog/esxi-vm-escape-exploit author: Matt Anderson, Dray Agha, Anna Pham (Huntress) date: 2026-01-02 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \kdu.exe - \hamakaze.exe - OriginalFileName: hamakaze.exe selection_cli_suspicious: CommandLine|contains: - '-map ' - '-prv ' - '-dse ' - '-ps ' condition: all of selection_* falsepositives: - Legitimate driver development, testing, or administrative troubleshooting (e.g., enabling/disabling hardware) level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_kdu_driver_tool/info.yml