Rule Info
Name
Scheduled Task Created via Remotely Hosted XML File
Author
Swachchhanda Shrawan Poudel (Nextron Systems), Marius Benthin (Nextron Systems)
Description
Detects schtasks.exe creating a new scheduled task using an XML definition file
hosted on a remote UNC path (hostname or IP address). Threat actors may use this technique
to load malicious task definitions from attacker-controlled or compromised file shares.
Reference
Date
2026-07-09 00:00:00
Modified
None
Id
4a6c8e0b-3f5d-4b7a-c9e1-6d8f0a2b4c6e
Tags
attack.persistence attack.execution attack.privilege-escalation attack.t1053.005
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR