Windows Suspicious .txt Creation in User Desktop via cmd.exe

title: Windows Suspicious .txt Creation in User Desktop via cmd.exe
id: 11a042a8-1407-4bb5-8305-4cf0f4944b82
status: test
description: This rule identifies file creation events where a .txt file is created under a user Desktop path by cmd.exe. Attackers may use this pattern to drop ransom notes or other user-facing text files during impact or extortion activity. Investigation should focus on the created filenames and whether there is related suspicious activity such as bulk text-file drops or concurrent encryption behavior. The detection relies on Windows file event telemetry that includes the creating process (cmd.exe) and the target file path.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1486/T1486.md#atomic-test-5---purelocker-ransom-note
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/file/file_event/file_event_win_susp_desktop_txt.yml
author: frack113, Huntrule Team
date: 2021-12-26
modified: 2026-01-09
tags:
  - attack.impact
  - attack.t1486
  - detection.threat-hunting
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith: \cmd.exe
    TargetFilename|contains|all:
      - \Users\
      - \Desktop\
    TargetFilename|endswith: .txt
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: caf02a0a-1e1c-4552-9b48-5e070bd88d11
    type: derived