Detects scheduled task used for persistence by Nimbus Manticore (UNC1549). The task is used to persistenly load a custom

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging scheduled tasks to establish persistent access via custom implants capable of data exfiltration and remote command execution, mirroring the behavior of Nimbus Manticore (UNC1549). Proactive hunting for this activity within Azure Sentinel is critical because scheduled task persistence often evades initial detection, allowing attackers to maintain long-term footholds that facilitate stealthy data theft and lateral movement.

YARA Rule

rule SUSP_ScheduledTasks_Nimbus_Manticore_Persistence_May26 {
   meta:
      description = "Detects scheduled task used for persistence by Nimbus Manticore (UNC1549). The task is used to persistenly load a custom implant that features data exfiltration and remote control capabilities."
      author = "Jonathan Peters (Nextron Systems)"
      date = "2026-05-27"
      reference = "https://www.nextron-systems.com/2026/06/01/detecting-nimbus-manticore-and-their-sideloading-infection-chains/"
      score = 75
   strings:
      $a0 = "<Task version=" wide
      $a1 = "xmlns=\"http://schemas.microsoft.com/windows/" wide

      $x1 = "<Arguments>doit" wide
   condition:
      uint16(0) == 0xfeff
      and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• https://www.nextron-systems.com/2026/06/01/detecting-nimbus-manticore-and-their-sideloading-infection-chains/
• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Nimbus Manticore (UNC1549) detection rule, including suggested filters or exclusions tailored for a legitimate enterprise environment:

• Enterprise Backup Solutions (e.g., Veeam, Commvault, Rubrik)

  • Scenario: Backup agents often create scheduled tasks to initiate nightly data synchronization or snapshot creation. These tasks frequently utilize PowerShell scripts or custom executables that load memory-resident modules for monitoring and control, mimicking the behavior of the Manticore implant’s persistence mechanism.
  • Filter/Exclusion: Exclude scheduled tasks where the Action executable path matches known backup software directories (e.g., C:\Program Files\Veeam\Backup and Replication Agent\...) or contains keywords like “Veeam”, “Commvault”, or “Rubrik” in the task name.

• Endpoint Detection and Response (EDR) Self-Management

  • Scenario: Major EDR platforms such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne create their own scheduled tasks to perform routine health checks, policy updates, or module reloads. These internal maintenance jobs often load custom DLLs or executables that possess remote control capabilities similar to the threat signature.
  • Filter/Exclusion: Whitelist tasks owned by specific service accounts associated with EDR vendors (e.g., CRON, SYSTEM running under CrowdStrike Falcon Service) and exclude task names containing “Falcon”, “Defender”, or “SentinelOne” in the trigger description.

• Patch Management and Configuration Tools (e.g., SCCM, Ansible, Puppet)

  • Scenario: Infrastructure automation tools like Microsoft Endpoint Configuration Manager (SCCM) or Ansible Tower utilize scheduled tasks to deploy patches or apply configuration profiles during maintenance windows. These jobs often execute