Skip to content

Hide Navigation Hide TOC

Suspicious Scheduled Task Creation via Masqueraded XML File (dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c)

Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence

Cluster A Galaxy A Cluster B Galaxy B Level
Match Legitimate Name or Location - T1036.005 (1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2) Attack Pattern Suspicious Scheduled Task Creation via Masqueraded XML File (dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c) Sigma-Rules 1
Suspicious Scheduled Task Creation via Masqueraded XML File (dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c) Sigma-Rules Scheduled Task - T1053.005 (005a06c6-14bf-4118-afa0-ebcd8aebb0c9) Attack Pattern 1
Masquerading - T1036 (42e8de7b-37b2-4258-905a-6897815e58e0) Attack Pattern Match Legitimate Name or Location - T1036.005 (1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2) Attack Pattern 2
Scheduled Task/Job - T1053 (35dd844a-b219-4e2b-a6bb-efa9a75995a9) Attack Pattern Scheduled Task - T1053.005 (005a06c6-14bf-4118-afa0-ebcd8aebb0c9) Attack Pattern 2