Rule Info
Name
Suspicious IPv4 Address In Scheduled Task Creation
Author
X__Junior
Description
Detects scheduled task creation using "schtasks" that contains reference to IPv4 address in the command line.
Threat actors schedule tasks that reach out to attacker-controlled IP addresses for persistence or exfiltration.
Date
2025-01-13 00:00:00
Modified
2026-10-09 00:00:00
Id
f5be4913-a66d-4726-95ea-88f638288b88
Tags
attack.persistence attack.execution attack.privilege-escalation attack.t1053.005
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR