alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Windows Scheduled Task XML Response from Server"; flow:established,to_client; http.stat_code; content:"200"; file.data; content:"|3c 3f|xml version|3d 22|1.0|22 3f 3e|"; startswith; content:"|3c|Task|20|"; within:8; content:"xmlns|3d 22|http|3a 2f 2f|schemas.microsoft.com|2f|windows|2f|2004|2f|02|2f|mit|2f|task|22 3e|"; fast_pattern; within:76; content:"|3c|RegistrationInfo|3e|"; distance:0; content:"|3c|Triggers|3e|"; distance:0; content:"|3c|Exec|3e|"; reference:url,learn.microsoft.com/en-us/windows/win32/taskschd/daily-trigger-example--xml-; reference:md5,10f4479d5f531def842a712277ae9611; classtype:bad-unknown; sid:2051514; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Windows_11, attack_target Client_and_Server, tls_state plaintext, created_at 2024_03_06, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Major, tag Scheduled_Task_Payload_Delivery, updated_at 2024_03_06; target:dest_ip;)