Windows: .txt Created on User Desktop via cmd.exe

Flags cmd.exe creating .txt files under user Desktop, a common ransomware-style artifact placement pattern.

FreeReviewedSigma · Medium · v5

Product: windows
Category: file_event
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2021-12-26
Updated: 2026-07-31

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1486Data Encrypted for Impact

What it detects

This rule flags file creation events where the creating process is cmd.exe and the target file path is under a user Desktop directory, with a .txt filename. Creating text files directly on the Desktop can be used by attackers to drop ransom notes or other user-visible artifacts. Investigation should focus on the specific filenames and whether there are signs of coordinated malicious activity around the same timeframe using available process and file telemetry.

Reporting behind it

Related detections9 linkedT1486 — drag to rearrange

Malicious Remote Encryptor Execution via WMIC Process Call Create (Chaos Ransomware)

Suspicious CyberLock Ransomware Encrypted File Creation

Rhysida Ransomware Encrypted File Extension Created

Phobos 8Base Ransomware Encrypted File Extension Created

Rhysida Ransomware Note CriticalBreachDetected.pdf Created

Possible Akira Ransomware Note or Encrypted Extension Creation

Malicious Storm-2603 Ransom Note File Creation

Possible Ransomware Note or Encrypted File Extension Creation

BitLocker Feature Activation on Multiple Hosts - Native (via bitlocker)

Windows: .txt Created on User Desktop via cmd.exe

Pivot detection · T1486 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-suspicious-txt-creation-in-user-desktop-via-cmd-exe-caf02a0a

title: "Windows: .txt Created on User Desktop via cmd.exe"
id: 11a042a8-1407-4bb5-8305-4cf0f4944b82
status: test
description: This rule flags file creation events where the creating process is cmd.exe and the target file path is under a user Desktop directory, with a .txt filename. Creating text files directly on the Desktop can be used by attackers to drop ransom notes or other user-visible artifacts. Investigation should focus on the specific filenames and whether there are signs of coordinated malicious activity around the same timeframe using available process and file telemetry.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1486/T1486.md#atomic-test-5---purelocker-ransom-note
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/file/file_event/file_event_win_susp_desktop_txt.yml
author: frack113, Huntrule Team
date: 2021-12-26
modified: 2026-01-09
tags:
  - attack.impact
  - attack.t1486
  - detection.threat-hunting
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith: \cmd.exe
    TargetFilename|contains|all:
      - \Users\
      - \Desktop\
    TargetFilename|endswith: .txt
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: caf02a0a-1e1c-4552-9b48-5e070bd88d11
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL