huntrule

Windows: .txt Created on User Desktop via cmd.exe

Flags cmd.exe creating .txt files under user Desktop, a common ransomware-style artifact placement pattern.

FreeReviewedSigma · Medium · v5
Product
windows
Category
file_event
Author
frack113 (SigmaHQ), DRL 1.1
Published
2021-12-26
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Impact

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags file creation events where the creating process is cmd.exe and the target file path is under a user Desktop directory, with a .txt filename. Creating text files directly on the Desktop can be used by attackers to drop ransom notes or other user-visible artifacts. Investigation should focus on the specific filenames and whether there are signs of coordinated malicious activity around the same timeframe using available process and file telemetry.

Reporting behind it

Related detections9 linkedT1486 — drag to rearrange
Malicious JADEPUFFER Lockd Encryptor Execution
Suspicious Mass Locked Extension File Creation by Ransomware
Malicious Interlock Ransomware Encrypted File and Note Creation (via file_event)
Malicious Ransomware Encryption Extension x2anylock
Malicious Fivehands Go Encryptor Execution via Command Line Flags
Malicious SafePay Ransomware Encryptor Command-Line Execution
Malicious The Gentlemen Ransomware Encryptor via Distinctive CLI Flags
Malicious GigaWiper Ransomware File Extension .candy
Malicious Forced BitLocker Encryption for Extortion (via process_creation)
Windows: .txt Created on User Desktop via cmd.exe
Pivot detection · T1486 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.