Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,051 detections
Filters
Last updated
All Time
Detection languages
502
165
77
75
69
Contributors
326
184
158
51
46
Categories
20,443
11,831
5,872
5,155
4,866
1,051
Platforms
927
119
22
11
4
Products / Services
408
280
229
193
114
MITRE Techniques
1,017
1,001
877
614
181
CVEs
2
1
1
1
1
IDS Classtypes
5
4
2
1
IDS Protocols
8
4
Detects the creation of the 'WSPrint' scheduled task followed by specific registry modifications intended to hide the task from the Task Scheduler UI. This is a known persistence technique used by the UAT-9244 actor for its TernDoor backdoor.
Detects the creation of a scheduled task named "Recovery Diagnostics" that executes PowerShell scripts from the C:\Users\Public directory. This specific technique has been observed being used by threat actors as a persistence and execution mechanism during INC ransomware staging to trigger base64-encoded PowerShell payloads for data exfiltration.
Detects the creation of a scheduled task using 'schtasks.exe' with specific command-line arguments that indicate an attempt to establish persistence. The rule looks for 'schtasks.exe' creating a task named 'Runtime Broker' that executes a program from a suspicious path within 'C:\ProgramData\Microsoft\Windows\Runtime\'. This pattern is often used by adversaries to maintain access to a system.
Detects the creation of a specific scheduled task used by Interlock ransomware to execute its payload with SYSTEM privileges.
Detects the creation of a scheduled task named 'Runtime Broker' that executes files from 'C:\ProgramData\Microsoft\Windows\Runtime\'. This technique is used by the Slopoly malware, deployed by the Hive0163 group, to establish persistence by masquerading as a legitimate Windows service.
Detects the creation of a scheduled task named 'TaskSystem' with SYSTEM privileges, a specific behavior of the Interlock ransomware.
This rule detects the creation of scheduled tasks with names specifically identified in the Bitdefender APT36 Vibeware report. These task names are used by APT36 to maintain persistence for their malware, often disguised as legitimate system processes.
Detects the creation or modification of scheduled tasks using 'schtasks.exe' where the task is configured to run under 'NT AUTHORITY\SYSTEM' or 'NT AUTHORITY\NETWORK SERVICE' (represented as 'SYSTEM' or 'NT AUT' in the command line), but the initiating process is not a standard system process. This can indicate an attempt to establish persistence or elevate privileges.
This rule detects artifacts associated with the APT36 CreepDropper malware, specifically focusing on scheduled task names and staging file markers. It looks for specific strings related to scheduled tasks like 'MicrosoftEdgesUpdatesTasksMachineUAs-Task' and 'MicrosoftEdgesUpdatesTasksMachineUAs-1234-87hy', as well as a staging file named 'ds.png' and other related strings such as 'msedge.exe', 'Task10', and 'System.Reflection.Assembly'. The rule requires at least four of these strings to be present, along with the MZ header, indicating a Windows executable.
Detects the creation of scheduled tasks with specific names and command-line patterns associated with the BadPaw PowerShell backdoor. This technique is used by the threat actor to establish persistence on the compromised system.
Detects the creation of a scheduled task designed to execute a VBScript from a temporary or user-specific directory. This technique is used by the Dead#Vax malware to establish persistence with a layer of indirection, avoiding direct PowerShell execution from the task itself.
This rule detects the creation or modification of scheduled tasks using specific names identified in the Bitdefender APT36 Vibeware report. The rule looks for `schtasks.exe` executions where the command line contains one of the following task names: "MicrosoftEdgesUpdatesTasksMachineUAs-Task", "MicrosoftEdgesUpdatesTasksMachineUAs-1234-87hy", "DateAndTimeService", "personalServiceTask", or "LuminousBackupService". This helps identify campaign-specific persistence mechanisms used by APT36 Vibeware.
This rule detects the creation of a scheduled task named "WSPrint" that executes "C:\ProgramData\WSPrint\WSPrint.exe" at system startup. This specific pattern of `schtasks.exe` usage, including the task name and program path, is associated with persistence mechanisms described in the Cisco Talos UAT-9244 report.
Detects the creation of a scheduled task designed to execute a VBScript from a temporary or user-specific directory. This technique is used by the Dead#Vax malware to establish persistence with a layer of indirection, avoiding direct PowerShell execution from the task itself.
Detects the creation of a 'WSPrint' scheduled task followed by deletion of its Security Descriptor (SD) registry value. Deleting the SD value hides the task from schtasks /query and Task Scheduler. This technique is used by UAT-9244 for stealthy persistence and is also associated with HAFNIUM/Tarrask.
Detects activity related to OpenClaw (aka Clawdbot or Moltbot) by searching for specific process command line strings, file path keywords, network listeners on port 18789, or scheduled tasks named 'OpenClaw'.
Detects persistence mechanisms used by the HoneyMyte APT group's CoolClient backdoor. The rule looks for the creation of a specific scheduled task ('ComboxResetTask') or the modification of a registry run key to include the 'work' parameter, which are characteristic of the backdoor's 'passuac' and 'install' routines.
Detects the creation of a scheduled task configured to execute a VBScript from a user's AppData folder. This technique is used by adversaries, including the Dead#Vax campaign, to establish persistence via an indirect execution flow, often to evade detections focused on direct PowerShell or cmd.exe task actions.
This rule detects various indicators associated with the SSHStalker botnet on Linux systems, including outbound IRC-like network connections, modifications to cron files for persistence, log tampering (specifically utmp/wtmp/lastlog files), and the execution of compilers from suspicious directories like /tmp or /dev/shm. Each section of the rule targets a specific behavior of the botnet.
This rule detects the creation of scheduled tasks (`schtasks.exe /create`) where the command line arguments contain suspicious executables or paths commonly associated with malicious activity. This indicates a potential persistence mechanism being established by an adversary.
Detects the creation or execution of a scheduled task named 'Batteries' pointing to the AppData Roaming directory, which is a specific persistence mechanism for the ValleyRAT campaign. This rule identifies the creation of the scheduled task via 'schtasks.exe', the creation of the legacy '.job' file for the task, or the execution of the payload 'WavesSvc64.exe' from its persistence location.
Page 43 of 51