Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,051 detections
Filters
Last updated
All Time
Detection languages
502
165
77
75
69
Contributors
326
184
158
51
46
Categories
20,443
11,831
5,872
5,155
4,866
1,051
Platforms
927
119
22
11
4
Products / Services
408
280
229
193
114
MITRE Techniques
1,017
1,001
877
614
181
CVEs
2
1
1
1
1
IDS Classtypes
5
4
2
1
IDS Protocols
8
4
Matanbuchus 3.0 Scheduled Task Creation
Cortex XDR
This rule detects the creation of a scheduled task named 'Update Tracker Task' using either 'schtasks.exe' or PowerShell cmdlets ('Register-ScheduledTask', 'New-ScheduledTask'). This specific task name has been associated with the Matanbuchus 3.0 loader.
Matanbuchus 3.0 Scheduled Task Creation
Cortex XDR
This rule detects the creation of a scheduled task named 'Update Tracker Task' using either 'schtasks.exe' or PowerShell cmdlets ('Register-ScheduledTask', 'New-ScheduledTask'). This specific task name has been associated with matanbuchus 3.0 loader.
Detects the creation of a scheduled task named 'WindowsHelper', which is used by Operation HumanitarianBait for persistence to launch its Python implant every 5 minutes. This rule specifically looks for command-line executions of 'schtasks.exe' or commands containing 'schtasks' that include '/create' and the task name 'WindowsHelper'.
Matanbuchus 3.0 Scheduled Task Creation
Cortex XDR
This rule detects the creation of a scheduled task named 'Update Tracker Task' using either 'schtasks.exe' or PowerShell cmdlets ('Register-ScheduledTask', 'New-ScheduledTask'). This specific task name has been associated with the Matanbuchus 3.0 loader.
Detects the creation of a scheduled task named 'MicrosoftEdgeUpdate' that leverages PowerShell to download and execute a payload. This technique was observed in an Iranian-Nexus operation against Oman's government.
This rule detects various activities associated with CloudZ and Pheno malware, including persistence mechanisms via scheduled tasks, execution of .NET loaders (regasm.exe), payload downloads using common utilities (curl, powershell, bitsadmin) from known staging patterns, reconnaissance artifacts, and network connections to known CloudZ infrastructure.
Detects the creation or modification of a specific scheduled task containing the string "M1onltor". This is an artifact of SHADOW-EARTH-053 establishing continuous persistence for their side-loaded malware loaders.
Detects the creation of the specific scheduled task 'SystemWindowsApis' or scheduled tasks querying for the malicious payload paths (e.g., 'windosDoc'), utilized for persistence by the CloudZ loader.
Detects the creation or modification of a ScheduledTasks.xml file within the SYSVOL directory, indicative of automated task deployment via Group Policy Preferences (GPP) commonly abused by adversaries. This activity can be used for persistence, privilege escalation, or lateral movement.
Detects the creation of a scheduled task executing binaries or scripts from the \Users\Public\ directory. This behavior has been observed in Tropic Trooper campaigns to maintain persistence and execute malicious payloads via the AdaptixC2 agent, but applies broadly to threat actors staging in the Public folder.
This rule detects multiple TTPs (Tactics, Techniques, and Procedures) associated with advanced adversaries, including QEMU virtualization abuse for defense evasion, creation of malicious scheduled tasks (specifically 'TPMProfiler'), rogue account or service creation (e.g., 'CtxAppVCOMService' or 'AppMgmt' service via 'sc.exe'), port forwarding/tunneling commands (using 'ssh' or 'portproxy' with specific ports), credential access attempts via 'vssuirun.exe' or printing 'NTDS.dit', and potential DLL sideloading involving 'ADNotificationManager.exe' and 'vcruntime140_1.dll'. It also includes IOCs for specific IPs, domains, and file hashes.
This query searches for multiple indicators associated with the STAC4713 and STAC3725 campaigns (often linked to PayoutsKing/GOLD ENCOUNTER). It utilizes a fast free-text pre-filter followed by a case statement to categorize specific TTPs, including QEMU abuse, rogue scheduled tasks, suspicious services/accounts, covert tunneling, and credential access.
Detects cron job creation or edits that execute payloads from temporary or writable directories.
Detects the creation or modification of a ScheduledTasks.xml file within the SYSVOL directory. This behavior indicates automated task deployment via Group Policy Preferences (GPP), a technique observed in The Gentlemen RaaS and other operations to simultaneously execute ransomware or other payloads across domain-joined computers.
Detects the creation of scheduled tasks associated with the Dragon Boss Solutions AV killer malware. These tasks (e.g., 'DisableClockServicesFirst', 'RemoveClockPeriodic') are critical for the malware's continuous AV suppression and deep cleanup operations across reboots and logons.
Detects the creation of crontab entries executing a payload masquerading as a legitimate Linux dynamic linker (ld-unix.so.2). Masjesu uses this highly specific path and filename combination to disguise its primary persistence mechanism.
Detects multiple activities associated with the CTRL framework, including hiding user accounts, persistence via scheduled tasks, UAC bypass using wlrmdr.exe, RDP shadow session hijacking, VPN disconnects via rasdial, and RDP restriction loosening.
Detects DeepLoad-related behavioral chains including ClickFix PowerShell execution, mshta retrieval, scheduled task persistence, Add-Type or APC style injection, LockAppHost or related target process launches, WMI based re-execution, filemanager.exe execution, USB spread indicators, and known DeepLoad infrastructure communication.
Detects the CTRL persistence pattern by correlating suspicious registry value modifications (using disguised names like 'ShellStateVersion1', 'IconSizeVersion1', 'IconUnderlineVersion1') with the creation of scheduled tasks via PowerShell or schtasks.exe. The scheduled tasks often involve hidden or encoded commands and are set to launch at startup or with specific system privileges.
This rule detects various stages of DeepLoad malware activity, including initial delivery via PowerShell execution policy bypass with IEX/IRM style ClickFix, network retrieval using mshta.exe, persistence mechanisms like scheduled task creation and WMI, fileless injection through PowerShell Add-Type compilation and suspicious child processes (LockAppHost.exe, makecab.exe, Magnify.exe), credential stealing via filemanager.exe, and USB propagation indicators including specific C2 paths and LNK themed installer names. It also identifies known DeepLoad infrastructure domains.
This rule detects various activities associated with the Kimsuky JavaScript dropper, including DNS requests to known malicious domains, creation of specific files (Themes.js, L298306.tmp), execution of certutil.exe or script.exe for decoding/encoding, suspicious command-line arguments for system information or task listing, and persistence mechanisms via scheduled tasks or registry modifications related to 'Themes.js' or 'Windows Theme Manager'.
Page 42 of 51