huntrule

Windows file creation by uncommon processes in AppData\Roaming\Microsoft (txt/xml)

Flags creation of .txt/.xml files in AppData\Roaming\Microsoft by schtasks.exe, wscript.exe, or mshta.exe.

FreeUnreviewedSigmahighv1
title: Windows file creation by uncommon processes in AppData\Roaming\Microsoft (txt/xml)
id: 1875e1ae-c163-430d-ba3f-41a52fa48648
status: test
description: This rule identifies file creation of .txt and .xml under the %AppData%\Roaming\Microsoft directory by uncommon parent processes. Attackers may use this technique to stage or deliver malicious content inside user roaming paths. The detection relies on Windows file event telemetry capturing the creating process (schtasks.exe, wscript.exe, or mshta.exe) and the target filename and location.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Devil-Bait/file_event_win_malware_devil_bait_script_drop.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-15
tags:
  - detection.emerging-threats
  - attack.stealth
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith:
      - \schtasks.exe
      - \wscript.exe
      - \mshta.exe
    TargetFilename|contains: \AppData\Roaming\Microsoft\
    TargetFilename|endswith:
      - .txt
      - .xml
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 93d5f1b4-36df-45ed-8680-f66f242b8415
    type: derived

What it detects

This rule identifies file creation of .txt and .xml under the %AppData%\Roaming\Microsoft directory by uncommon parent processes. Attackers may use this technique to stage or deliver malicious content inside user roaming paths. The detection relies on Windows file event telemetry capturing the creating process (schtasks.exe, wscript.exe, or mshta.exe) and the target filename and location.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.