Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,051 detections
Filters
Last updated
All Time
Detection languages
502
165
77
75
69
Contributors
326
184
158
51
46
Categories
20,443
11,831
5,872
5,155
4,866
1,051
Platforms
927
119
22
11
4
Products / Services
408
280
229
193
114
MITRE Techniques
1,017
1,001
877
614
181
CVEs
2
1
1
1
1
IDS Classtypes
5
4
2
1
IDS Protocols
8
4
This rule monitors for patterns associated with the Gamaredon (ACTINIUM) threat group's PowerShell loaders (e.g., Ptero-family) and the Kazuar backdoor. It specifically detects indicators such as malicious PowerShell command lines, NTFS alternate data stream manipulation, and suspicious scheduled task creation.
This rule detects the creation of a scheduled task using 'schtasks.exe' that includes a PowerShell command with 'invoke-expression' (iex) and 'invoke-restmethod' (irm) to ensure persistence across reboots. This behavior is characteristic of the DeepLoad malware, often delivered via ClickFix campaigns.
Detects when a non-root user modifies, creates, or renames files within common cron directories or the main crontab file on Linux systems. This activity can indicate an attempt to establish persistence or schedule malicious tasks.
Detects the creation of scheduled tasks using 'schtasks.exe' with command line arguments that indicate suspicious activity. This includes tasks created in common temporary or user-writable directories, or tasks that involve PowerShell with encoded commands or obfuscated strings, which are often used by adversaries for persistence or execution.
Detects the creation of a scheduled task via schtasks.exe that executes a command interpreter or script engine (e.g., PowerShell, cmd, wscript) where the parent process is not signed by Microsoft. This behavior is often associated with the execution of malicious payloads, persistence mechanisms, or lateral movement.
This rule detects potential persistence attempts by monitoring for the execution of 'schtasks.exe' with the '/create' flag or the loading of 'taskschd.dll' by suspicious parent processes. These parents include script interpreters (e.g., powershell, wscript), Microsoft Office applications, and various living-off-the-land binaries or web-related utilities, which are commonly abused by adversaries to establish persistence via the Windows Task Scheduler.
This rule identifies the Potemkin Loader establishing persistence by creating a scheduled task. The scheduled task is configured to execute a Remote Monitoring and Management (RMM) payload upon user logon or system startup. Detection is based on `schtasks.exe` command-line arguments that include `/create`, `/tn` (task name), and `/tr` (task run) pointing to an executable within an `AppData` directory.
Detects the creation of scheduled tasks using schtasks.exe, where the command line arguments reference known LOLBins (Living Off the Land Binaries) such as certutil, regsvr32, mshta, wscript, cscript, rundll32, or encoded command execution via cmd.exe. This activity often indicates an attempt to establish persistence or execute malicious code using trusted system binaries.
This rule identifies the Potemkin Loader establishing persistence by creating a scheduled task. The scheduled task is configured to execute a Remote Monitoring and Management (RMM) payload upon user logon or system startup. Detection is based on `schtasks.exe` command-line arguments that include `/create`, `/tn` (task name), and `/tr` (task run) pointing to an executable within an AppData directory.
Detects potential persistence activity associated with LegionLoader by monitoring for the execution of an MSI installer from user-writable directories (e.g., AppData, Temp), followed by the creation of a scheduled task via schtasks.exe, and the creation of files within the AppData\Roaming directory within a 5-minute window.
This rule monitors for the creation of scheduled tasks using the Windows 'schtasks.exe' utility that contain command-line strings associated with BeepRAT malware activity. Specifically, it identifies task names or configurations used for persistence or payload execution, such as 'WindowsUpdateTempFileCleanUp', 'TCC\\config.ini.c', 'HFY.exe', and various TCC loader arguments.
Detects the use of the 'schtasks.exe' utility with command line arguments containing strings associated with suspicious activity or known malicious patterns, such as file cleanup or configuration manipulation, often used for persistence or stealthy execution.
Detects indicators of the BeepRAT malware (associated with Operation DragonClone), including specific process execution patterns of HFY.exe, LuaJit.exe, or tcc.exe, network connections to known C2 infrastructure on port 18848, keylogger file creation, and malicious task scheduling or TCC loader execution techniques.
Detects the creation of scheduled tasks using schtasks.exe with command-line arguments that contain suspicious file names, paths, or flags often associated with malicious behavior, such as persistence mechanisms or potential lateral movement tools.
Detects the creation of scheduled tasks using 'schtasks.exe' with command-line arguments containing specific patterns such as 'WindowsUpdateTempFileCleanUp', 'config.ini.c', 'SchTask_x86', or 'SchTask_x64'. These patterns are often associated with the deployment of malicious persistence mechanisms or software execution.
Detects evidence of SystemBC (Coroxy) malware persistence, characterized by the creation of a scheduled task using 'schtasks.exe' that executes a random binary residing in '%ProgramData%' with a 'start' argument, coupled with concurrent modifications to the Windows 'Run' registry keys in a persistent path.
Detects behavioral indicators of the SystemBC (Coroxy) malware, including suspicious task scheduling, hidden PowerShell relaunch routines, use of staging binary names, and anomalous svchost.exe injection patterns. This rule focuses on detecting the multi-stage persistence and proxy behavior typical of SystemBC in pre-ransomware intrusion chains.
Detects the establishment of persistence via Registry Run keys, Scheduled Tasks, or Windows Services, where the executed file or binary path is located in suspicious directories such as AppData, Temp, or ProgramData. This indicates potentially malicious code staged in temporary or user-writable locations to maintain access.
This rule detects potentially malicious activities related to the manipulation of Group Policy Objects (GPOs) within an Active Directory environment. It identifies the execution of scripts or processes that create, modify, or force GPO updates (e.g., using 'gpupdate /force'), the deployment of suspicious GPO-related files like 'deploy_gpo.ps1', the manual modification of 'ScheduledTasks.xml' within the SYSVOL directory, and the use of PowerShell to disable real-time monitoring via GPO configuration changes.
Detects persistence mechanisms associated with the SHARDLOADER malware family, including the creation of suspicious scheduled tasks and modification of registry run keys. The rule monitors processes, scheduled task events, and registry value changes for specific indicators such as paths in C:\ProgramData\IDM\logs\, files named 'pcl2bmp' or 'mediuminststart', and DLL sideloading patterns involving SolidPDFCreator.
Detects a batch or script artifact that creates a scheduled task named 'ApphostRagistreationVerifier' (a likely typo for 'ApphostRegistrationVerifier') which is configured to execute a file located within the 'Windows\Fonts\' directory. The detection specifically looks for the presence of 'schtasks' command, 'ONSTART' trigger, and 'SYSTEM' user context, indicating a persistent scheduled task.
Page 35 of 51