Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,051 detections
Filters
Last updated
All Time
Detection languages
502
165
77
75
69
Contributors
326
184
158
51
46
Categories
20,443
11,831
5,872
5,155
4,866
1,051
Platforms
927
119
22
11
4
Products / Services
408
280
229
193
114
MITRE Techniques
1,017
1,001
877
614
181
CVEs
2
1
1
1
1
IDS Classtypes
5
4
2
1
IDS Protocols
8
4
Detects piping 'echo' directly into 'crontab -' to install cron jobs non-interactively, a standard method for scripted persistence.
Identifies schtasks.exe creating persistence mechanisms configured with both logon and startup triggers simultaneously, a signature of the CheckRealtekAudioVersion task.
Detects schtasks.exe establishing persistence using task names that spoof legitimate Windows services (e.g., Synchronize OS, Windows System Health, BackupCheck, WindowsSecurityUpdate).
Detects cron job creation for Linux persistence or execution
This rule detects potential lateral movement activities post-compromise by monitoring process creation events (EventID 4688, 4689) for common administrative tools like PsExec, WMIC, and commands related to scheduled tasks. It specifically looks for these tools being used to execute commands on multiple target computers from a single initiating account within a short timeframe (2 hours), indicating an adversary attempting to move across the network.
Detects the creation of specific systemd service files, macOS LaunchAgents, or payload files ('update.py') used by the Miasma toolkit for its GitHub polling backdoor. This rule identifies file creation or modification events indicative of the Miasma toolkit establishing persistence on Linux and macOS systems.
Detects the creation and subsequent deletion of a scheduled task within a short timeframe (5 minutes), which can indicate an attacker attempting to cover their tracks after executing a malicious task.
Detects the creation of scheduled tasks using `schtasks.exe` that include encoded PowerShell commands or base64 strings in their actions. This rule specifically looks for the use of `-EncodedCommand`, `-enc`, `-e`, `powershell`, `FromBase64String`, `IEX`, `Invoke-Expression`, and paths like `AppData`, `Temp`, or `ProgramData` within the command line, which are indicators of the PRISMEX implant used by APT28 for persistence.
Detects the creation of specific scheduled tasks known to be used by ScarCruft (APT37) to establish persistence for NarwhalRAT. The rule looks for scheduled task creation events (EventID 4698 in SecurityEvent logs or ActionType 'ScheduledTaskCreated' in DeviceEvents) where the task name matches known malicious task names used by ScarCruft, specifically 'MicrosoftUserInterfacePicturesUpdateTackMachine' and 'MicrosoftMusicLibrariesPackageTaskMachine'.
Detects if the backdoor file 'install-persistent.php' is scheduled for persistence via cron or Windows scheduled tasks. This indicates a potential supply chain compromise targeting ShapedPlugin.
This rule detects the creation or modification of a Windows scheduled task that includes 'deno' in its command line. This activity is suspicious as it can indicate malware establishing persistence on a system, especially on typical office PCs where Deno is not commonly used. Further investigation is recommended to determine if the activity is legitimate or malicious.
Detects the creation of a scheduled task used by NarwhalRAT for persistence, using a specific task name and execution pattern. The rule looks for 'schtasks.exe' being executed with '/create' or '-create' flags and the unique task name 'MicrosoftUserInterfacePicturesUpdateTackMachine'. It covers process creation events from DeviceProcessEvents, SecurityEvent (EventID 4688), and Sysmon (EventID 1).
Detects the creation of a scheduled task named 'SoftwareProtection' that executes a Python payload, indicative of ModeloRAT persistence.
Detects the creation of a scheduled task named 'AlphaSecurity' using schtasks.exe with the '/create' command-line argument. This specific task name and creation method have been associated with the Broomstick backdoor, which is used by the Rhysida ransomware group for persistence.
This rule detects potential lateral movement activities post-compromise by monitoring process creation events (EventID 4688, 4689) for common administrative tools like PsExec, WMIC, and commands related to scheduled tasks. It specifically looks for these tools being used to execute commands on multiple target computers from a single initiating account within a short timeframe (2 hours), indicating an adversary attempting to move across the network.
This rule detects the creation of scheduled tasks (Event ID 4698) that are configured to execute scripting languages (PowerShell, cmd, Python, Java) with hidden window styles. This behavior is often indicative of an adversary attempting to establish persistence while evading detection by hiding the execution of their malicious scripts.
Detects the creation of a scheduled task named 'XenoUpdateManager' using 'schtasks.exe', which is associated with the Operation XENOFISCAL campaign and the SideCopy threat group. The rule also surfaces the parent process that initiated the scheduled task creation.
Detects the creation of the WindowsVaultSyncService scheduled task or a task using the specific misleading description observed in SHEETCREEP (APT36) infections. The malware uses the Task Scheduler COM API to establish persistence.
This rule detects the creation of scheduled tasks (Event ID 4698) that are configured to execute scripting languages (PowerShell, cmd, Python, Java) with hidden window styles. This behavior is often indicative of an adversary attempting to establish persistence while evading detection by hiding the execution of their malicious scripts.
This rule detects the creation of scheduled tasks (Event ID 4697) where the command line contains either 'System' or 'Admin'. This could indicate an attempt to create a scheduled task that runs with elevated privileges or impersonates system/admin accounts for persistence or privilege escalation.
Detects the creation or modification of a scheduled task named 'OneDrive Update', which is known to be used by the BLUERABBIT backdoor for persistence. The rule looks for Windows Security Events (EventID 4698 for task creation, 4702 for task modification) and process execution events where command lines contain 'OneDrive Update' along with scheduled task registration utilities like 'Register-ScheduledTask', 'New-ScheduledTask', or 'schtasks'.
Page 39 of 51