Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,051 detections
Filters
Last updated
All Time
Detection languages
502
165
77
75
69
Contributors
326
184
158
51
46
Categories
20,443
11,831
5,872
5,155
4,866
1,051
Platforms
927
119
22
11
4
Products / Services
408
280
229
193
114
MITRE Techniques
1,017
1,001
877
614
181
CVEs
2
1
1
1
1
IDS Classtypes
5
4
2
1
IDS Protocols
8
4
Detects systemd timer unit file creation for Linux scheduled task persistence
Detects the creation of scheduled tasks that use `schtasks.exe` to execute `rundll32.exe`. This is a common technique used by attackers for persistence and to execute malicious DLLs, often to bypass application whitelisting or other security controls.
Detects cron job creation for Linux persistence or execution
This rule detects attempts to write or modify cron persistence entries via HTTP. Specifically, it looks for HTTP client body content containing the string "/etc/cron" (case-insensitive). This indicates a potential attacker trying to establish persistence on a Linux system by scheduling malicious tasks.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
Detects the creation of scheduled tasks that use `schtasks.exe` to execute `rundll32.exe`. This is a common technique used by attackers for persistence and to execute malicious DLLs, often to bypass application whitelisting or other security controls.
This rule detects HTTP requests that contain 'schtasks' and '/create' in the URI, indicating an attempt to create a scheduled task. This activity is often associated with adversaries establishing persistence or executing commands on a compromised system, potentially breaking the process tree for forensic analysis. The rule specifically looks for these keywords in a case-insensitive manner within the HTTP URI.
This rule generates a comprehensive forensic timeline for a specific executable file, analyzing its origin (file creation/drops), execution context (process creation and child processes), network communications (outbound connections), and persistence mechanisms (registry modifications for run keys/startup and scheduled task creation/updates). It correlates events across different data sources based on the executable's file name or SHA256 hash.
Detects scheduled tasks created with embedded PowerShell XOR decoding logic, ReadAllBytes, and Invoke-Expression techniques that may be used to establish persistence and execute obfuscated payloads. The rule specifically looks for 'schtasks.exe' creating a task with '/create', containing 'OneDrive', 'Startup', 'Task' in the command line, and also includes '-bxor', 'ReadAllBytes', 'iex', and '[Text.Encoding]::UTF8.GetBytes' which are indicative of obfuscated PowerShell execution via XOR decoding.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
Remote AT Job Scheduled via SMB
Suricata
This rule detects attempts to schedule a remote AT job via SMB. It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, containing the case-insensitive strings "atsvc" and "JobAdd". This combination indicates an attempt to use the AT service to add a scheduled task remotely, which can be a method for persistence or execution by attackers.
This rule detects HTTP traffic where the URI contains both 'schtasks' and '/delay' (case-insensitive). This combination suggests an attempt to create a scheduled task with a delayed execution, which can be used by adversaries for sandbox evasion or persistence.
Detects the creation of a scheduled task intended to execute a VBScript (.vbs). This technique is notably used by a North Korean-linked npm infostealer RAT to establish login persistence via a hidden VBS launcher.
This rule detects the creation or modification of scheduled tasks (EventID 4698 or 4699) where the command line for the task contains references to scripting languages like PowerShell, cmd, or VBScript. It then groups these events by computer and user, flagging if two or more such tasks are created by the same user on the same computer, which could indicate malicious activity.
Detects execution and persistence mechanisms associated with the
MicrosoftSystem64 payload observed in malicious npm supply-chain
campaigns. The rule focuses on stable post-compromise artifacts
including execution, scheduled tasks, services, registry Run keys,
and startup folder persistence.
MicrosoftSystem64 payload observed in malicious npm supply-chain
campaigns. The rule focuses on stable post-compromise artifacts
including execution, scheduled tasks, services, registry Run keys,
and startup folder persistence.
This rule detects when a cron job is created or modified via a remote SSH session. It specifically looks for the string "crontab -e" within TCP traffic destined for port 22 (SSH), indicating an interactive session where a user is editing their crontab file. This activity, when originating from a remote SSH session, could be indicative of an attacker establishing persistence or scheduling malicious tasks on a compromised system.
This rule detects the creation of scheduled tasks using `schtasks.exe` or `at.exe` with specific command-line arguments (`/create`, `/tn`, and either `/ru` or `/tr`). It then correlates these process events with registry events related to Task Scheduler keys or values containing "Task" to identify potential persistence mechanisms.
This rule detects the creation or modification of scheduled tasks (EventID 4698 or 4699) where the command line for the task contains references to scripting languages like PowerShell, cmd, or VBScript. It then groups these events by computer and user, flagging if two or more such tasks are created by the same user on the same computer, which could indicate malicious activity.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
Detects indicators associated with the MiniUpdate RAT deployed by the threat group Screening Serpens. This rule identifies network connections to known C2 domains, the creation of a persistence scheduled task named 'WindowsSecurityUpdate', and the dropping of specific RAT module DLLs ('UpdateChecker.dll', 'InitInstall.dll', 'Updater.dll') in common user-writable directories. The file event detection is tuned to require multiple generic DLLs or the presence of 'InitInstall.dll' to reduce false positives.
This rule detects the creation of remote scheduled tasks over SMB by looking for the string "schtasks" in TCP traffic destined for port 445 (SMB). This activity is often associated with persistence techniques where attackers establish scheduled tasks on remote systems.
Page 40 of 51