Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,051 detections
Filters
Last updated
All Time
Detection languages
502
165
77
75
69
Contributors
326
184
158
51
46
Categories
20,443
11,831
5,872
5,155
4,866
1,051
Platforms
927
119
22
11
4
Products / Services
408
280
229
193
114
MITRE Techniques
1,017
1,001
877
614
181
CVEs
2
1
1
1
1
IDS Classtypes
5
4
2
1
IDS Protocols
8
4
Detects the creation of a scheduled task using schtasks.exe that is triggered by a network connection event (Event ID 10000 from the NetworkProfile provider). This is an unusual persistence technique used by the CRESCENTHARVEST malware to ensure execution only when the machine is online.
Detects the dynamic creation of a scheduled task where cmd.exe first writes an XML task definition file to disk, which is then immediately used by schtasks.exe to create the task. This is a characteristic behavior of the APT28 "Operation MacroMaze" campaign.
Detects the creation of a scheduled task characteristic of OysterLoader persistence. The malware creates a task to execute its dropped DLL in the AppData\Roaming directory using rundll32.exe and the DllRegisterServer export.
This rule detects various activities associated with the 'CrashFix' variant of the 'Clickfix' malware, which deploys a Python-based Remote Access Trojan (RAT). The detection logic covers several stages of the attack:
1. **Browser Extension Installation**: Identifies the creation of a specific malicious Chrome extension file (.crx) with a unique identifier.
2. **Command and Control (C2) Traffic**: Monitors network connections to known malicious URLs and IP addresses associated with the malware's C2 infrastructure.
3. **Malicious Hashes**: Detects the execution of processes with specific SHA256 hashes known to belong to the CrashFix malware.
4. **LOLBIN Abuse**: Identifies the use of living-off-the-land binaries (LOLBINs) like 'finger.exe' and 'ct.exe' in suspicious command-line combinations, potentially for discovery or execution.
5. **Malicious IP Communication**: Looks for network connections initiated by 'ct.exe' with the 'confirm' argument, indicating communication with potentially malicious remote IPs.
6. **Python TTPs**: Detects Python execution patterns, specifically 'pythonw.exe' running 'modes.py' and making outbound network connections to non-local IPs, indicative of the Python RAT.
7. **Persistence via Registry Run Key**: Monitors for registry modifications related to 'pythonw.exe modes.py', suggesting persistence mechanisms.
8. **Persistence via Scheduled Task**: Identifies the creation of scheduled tasks that execute 'run.exe' and 'udp.pyw', another persistence method.
1. **Browser Extension Installation**: Identifies the creation of a specific malicious Chrome extension file (.crx) with a unique identifier.
2. **Command and Control (C2) Traffic**: Monitors network connections to known malicious URLs and IP addresses associated with the malware's C2 infrastructure.
3. **Malicious Hashes**: Detects the execution of processes with specific SHA256 hashes known to belong to the CrashFix malware.
4. **LOLBIN Abuse**: Identifies the use of living-off-the-land binaries (LOLBINs) like 'finger.exe' and 'ct.exe' in suspicious command-line combinations, potentially for discovery or execution.
5. **Malicious IP Communication**: Looks for network connections initiated by 'ct.exe' with the 'confirm' argument, indicating communication with potentially malicious remote IPs.
6. **Python TTPs**: Detects Python execution patterns, specifically 'pythonw.exe' running 'modes.py' and making outbound network connections to non-local IPs, indicative of the Python RAT.
7. **Persistence via Registry Run Key**: Monitors for registry modifications related to 'pythonw.exe modes.py', suggesting persistence mechanisms.
8. **Persistence via Scheduled Task**: Identifies the creation of scheduled tasks that execute 'run.exe' and 'udp.pyw', another persistence method.
This rule set detects the OysterLoader malware. The first rule, 'OysterLoader_Mutex_and_TaskNames', identifies the malware based on specific mutex names, scheduled task names, and user-agent strings ('WordPressAgent' and 'FingerPrint') used by OysterLoader. The second rule, 'OysterLoader_C2_Endpoint_Strings', focuses on identifying OysterLoader by detecting specific C2 API paths used for communication with its command and control server. Both rules require the presence of a valid PE file header (MZ magic bytes).
Detects suspicious creation of scheduled tasks via schtasks.exe using elevated accounts (Administrator, SYSTEM, NT AUTHORITY), excluding local host targets.
OysterLoader uses a Windows scheduled task to keep itself running. It creates a task with a name that looks like a normal security or updater tool, so it blends in. The task runs repeatedly in the background, helping the malware come back even after a restart and making it harder to notice or remove.
This rule detects the creation of a scheduled task characteristic of OysterLoader's persistence mechanism. The malware creates a task set to run every 13 minutes, which executes a malicious DLL from the AppData\Roaming directory using rundll32.exe.
Detects the creation of a scheduled task named 'SoftwareProtection' that executes a Python script. This technique is used by the CrashFix variant to establish persistence for its Python-based RAT, mimicking a legitimate Windows service to blend in. The malware drops its components into a subfolder of AppData to masquerade as a legitimate platform component.
Detects the creation of a scheduled task named 'SoftwareProtection' that executes a Python script. This is a persistence mechanism used by the CrashFix campaign to masquerade as a legitimate Windows service.
Detects the creation of a scheduled task named "TPMProfiler" that executes QEMU ('qemu-system-x86_64.exe'). This technique was observed being used by threat actors to establish persistence after exploiting SolarWinds Web Help Desk vulnerabilities.
Detects the creation of a scheduled task named 'SoftwareProtection' used by the CrashFix campaign to execute a renamed Python interpreter for persistence.
Detects the use of QEMU with port forwarding (`hostfwd`), a technique observed being used by attackers to create a persistent, virtualized environment for C2 and lateral movement, often via a scheduled task. The rule looks for the creation of scheduled tasks that launch QEMU with port forwarding or the direct execution of QEMU with port forwarding by common parent processes associated with scheduled tasks or remote administration.
Detects a specific persistence mechanism where a scheduled task named 'TPMProfiler' is used to run QEMU, establishing an SSH backdoor. This technique was identified by Huntress in post-exploitation activity related to SolarWinds WHD exploitation. The rule identifies both the execution of QEMU with SSH port forwarding command-line arguments and the creation of the malicious scheduled task.
Detects TTPs associated with the Lazarus Group malware families OtterCookie and BeaverTail. This rule identifies persistence via registry run keys and scheduled tasks, suspicious node.js execution for keylogging, and network connections to known C2 infrastructure.
Detects persistence mechanisms used by the OtterCookie malware, part of the Lazarus "Contagious Interview" campaign. It specifically looks for the creation of a 'NodeHelper' registry run key and a 'NodeUpdate' scheduled task.
Detects the multi-stage DEAD#VAX infection chain by correlating the creation of a specific batch file artifact with subsequent execution, persistence, or process injection activities.
Detects persistence mechanisms used by the Interlock RAT, which leverages specific, deceptive scheduled task names related to Defrag, Chkdsk, and TimeSync to maintain a foothold on compromised systems.
Detects the creation of scheduled tasks using 'schtasks /create' that include suspicious command-line arguments often associated with malicious activity, such as PowerShell execution, web requests (Invoke-WebRequest, curl, wget, bitsadmin), or script execution (.ps1, .vbs, .js). This rule aims to identify persistence mechanisms or initial access attempts.
Detects the creation of scheduled tasks used for persistence by fake PDF converter malware. These tasks are created in the registry under the TaskCache tree.
Detects the creation of scheduled tasks with specific names and command lines used by the TamperedChef malware for persistence.
Page 44 of 51