Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,051 detections
Filters
Last updated
All Time
Detection languages
502
165
77
75
69
Contributors
326
184
158
51
46
Categories
20,443
11,831
5,872
5,155
4,866
1,051
Platforms
927
119
22
11
4
Products / Services
408
280
229
193
114
MITRE Techniques
1,017
1,001
877
614
181
CVEs
2
1
1
1
1
IDS Classtypes
5
4
2
1
IDS Protocols
8
4
Detects the creation of scheduled tasks using the 'schtasks.exe' utility with the '/Create' argument. This can indicate an adversary establishing persistence or scheduling malicious activity.
Detects scheduled tasks configured to run as SYSTEM executing suspicious binaries or commands, often used for privilege escalation and defense evasion.
Detects the use of Visual Studio Code (VSCode) tunnels for command and control (C2) or persistence. This technique, observed in use by threat actors like MUSTANG PANDA, leverages legitimate VSCode functionality to bypass network defenses.
Detects the creation or modification of scheduled tasks that execute Python scripts or masquerade as legitimate system processes. This behavior is used by threat actors in the 'Contagious Interview' campaign to establish persistence.
Detects a Python process creating a scheduled task or adding a Windows Defender exclusion, a technique used by malware like InvisibleFerret for persistence and defense evasion.
This rule detects the presence of the PowerShell cmdlet 'Set-ScheduledTask' within the HTTP response body. This could indicate an attacker using a web-based mechanism to deliver or execute commands related to scheduled task creation or modification on a compromised system, potentially for persistence.
This rule detects the presence of the 'schtasks /create' command within the HTTP response body. This could indicate an adversary attempting to schedule tasks on a compromised system by delivering the command via an HTTP response, potentially for persistence or execution.
This rule detects the presence of the PowerShell cmdlet 'Start-ScheduledTask' within the HTTP response body. This could indicate an attacker attempting to establish persistence on a compromised system by creating scheduled tasks, potentially delivered via a web-based command and control channel or during an exploit.
This rule detects the presence of the PowerShell cmdlet 'Register-ScheduledTask' within an HTTP response body. This could indicate an attacker attempting to establish persistence on a compromised system by creating a scheduled task, potentially delivered via a web-based command and control channel or a malicious download.
This rule detects the presence of the PowerShell cmdlet 'New-ScheduledTask' and related parameters ('-action', '-trigger', '-taskname', '-settings') within the HTTP response body. This could indicate a system receiving instructions to create a scheduled task, potentially for persistence or execution of malicious code. The detection specifically looks for successful HTTP status code 200 responses.
Detects various activities associated with the UTA0388 threat actor and their GOVERSHELL malware family. This includes network connections to known C2 infrastructure, creation of persistence via scheduled tasks, and execution of the malware payload, often involving DLL side-loading. The detection logic covers network communication with known C2 domains and IPs, creation of scheduled tasks with specific names, execution of the malware from common staging directories with specific flags, and the dropping of GOVERSHELL DLLs or files with known hashes.
Detects the creation of remote scheduled tasks by monitoring access to the 'atsvc' named pipe over SMB. This activity is indicative of using tools like 'at.exe' or direct API calls to schedule tasks on a remote system, which can be leveraged for privilege escalation, execution, lateral movement, or persistence.
This rule detects persistence mechanisms used by the Kapeka backdoor. It specifically looks for the creation of a scheduled task named "Sens Api" (or "OneDrive" in some cases) via `schtasks.exe` set to run on system startup, or the addition of an autorun registry entry named "Sens Api" under `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` via `reg.exe`. Both persistence methods are identified by their command lines calling `rundll32` with a `.wll` file and the export ordinal `#1`.
This rule detects the remote creation of scheduled tasks by monitoring access to the 'ATSVC' named pipe within the IPC$ share. Specifically, it looks for Event ID 5145, indicating a detailed file share access, where the ShareName is '\\*\IPC$', the RelativeTargetName is 'atsvc', and the AccessList contains 'WriteData'. This activity is characteristic of tools like 'at.exe' or direct API calls used to schedule tasks remotely.
Detects remote RPC calls to create or execute a scheduled task via the Advanced Telephony Service (ATSvc) interface. This activity can be indicative of lateral movement, privilege escalation, or persistence mechanisms used by adversaries.
This rule detects the creation or registration of scheduled tasks using PowerShell cmdlets or WMI methods. It specifically looks for the use of `New-ScheduledTaskAction`, `New-ScheduledTaskTrigger`, `New-ScheduledTaskPrincipal`, `New-ScheduledTaskSettingsSet`, `New-ScheduledTask`, `Register-ScheduledTask` cmdlets, or the `Invoke-CimMethod` cmdlet targeting the `PS_ScheduledTask` class within the `Root\Microsoft\Windows\TaskScheduler` namespace. This activity is often abused by adversaries for persistence, privilege escalation, and execution.
This rule detects suspicious DCE-RPC function calls that indicate remote execution techniques on a Windows system. It specifically looks for operations related to scheduled tasks (JobAdd, SchRpcEnableTask, SchRpcRegisterTask, SchRpcRun), WMI execution (ExecMethod, ExecMethodAsync), and service creation/start (CreateServiceA/W, StartServiceA/W). These activities are commonly abused by adversaries for initial access, persistence, and lateral movement.
Detects the use of 'at' or 'atd' utilities, which are commonly abused by adversaries for persistence or to schedule the execution of malicious code. This rule specifically looks for the execution of '/at' or '/atd' binaries.
Detects the creation of scheduled tasks with specific names ('SC Scheduled Scan' or 'UpdatMachine') that have been associated with the OilRig APT group for persistence, as reported by Nyotron in March 2018.
Detects the creation or modification of scheduled tasks via Group Policy Objects (GPO), which can be used by adversaries for persistence, execution, and lateral movement, often seen in ransomware deployment scenarios. The rule specifically looks for Event ID 5136 (Directory Service Changes) indicating modifications to GPO attributes related to machine or user extension names, and Event ID 5145 (Detailed File Share) indicating write access to ScheduledTasks.xml within the SYSVOL share.
Detects remote RPC calls to the ITaskSchedulerService interface, specifically focusing on operations that create or execute scheduled tasks. This behavior is commonly associated with lateral movement and persistence techniques. The rule leverages an RPC Firewall to monitor these specific RPC calls.
Page 45 of 51