Operation XENOFISCAL - Schtasks Creating XenoUpdateManager

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•1

Detects the creation of a scheduled task named 'XenoUpdateManager' using 'schtasks.exe', which is associated with the Operation XENOFISCAL campaign and the SideCopy threat group. The rule also surfaces the parent process that initiated the scheduled task creation.