Rule Info
Name
Scheduled Task Execution with Hardcoded IPv4 Address
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects a process spawned by the Windows Task Scheduler whose command line contains a hardcoded IPv4 address.
This may indicate the execution of a task previously created to reach out to attacker-controlled IP addresses for persistence or exfiltration.
Date
2026-07-10 00:00:00
Modified
None
Id
e1daed3d-8e57-484c-a757-f8f30f93ceac
Tags
attack.execution attack.persistence attack.privilege-escalation attack.t1053.005
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR