Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,051 detections
Filters
Last updated
All Time
Detection languages
502
165
77
75
69
Contributors
326
184
158
51
46
Categories
20,443
11,831
5,872
5,155
4,866
1,051
Platforms
927
119
22
11
4
Products / Services
408
280
229
193
114
MITRE Techniques
1,017
1,001
877
614
181
CVEs
2
1
1
1
1
IDS Classtypes
5
4
2
1
IDS Protocols
8
4
The following analytic detects the creation or modification of hidden scheduled tasks on Windows systems, which are not visible in the UI. It leverages Windows Security EventCode 4698 to identify tasks where the 'Hidden' setting is enabled. This behavior is significant as it may indicate malware activity, such as Industroyer2, or the use of living-off-the-land binaries (LOLBINs) to download additional payloads. If confirmed malicious, this activity could allow attackers to execute code stealthily, maintain persistence, or further compromise the system by downloading additional malicious payloads.
Detects suspicious scheduled task creation (schtasks.exe /create) linked to known Subtle Snail file hashes, malicious payload filenames, and recruitment paths. Correlates with parent processes commonly abused (browsers, explorer) and excludes benign system processes and service accounts. Aggregates events to highlight clustered activity for effective threat hunting.
This analytic detects the creation of scheduled tasks on Windows systems where the command arguments include HTTP strings. This behavior is often indicative of malware activity or the use of Living off the Land binaries (LOLBins) to download additional payloads. Such activity, if malicious, could lead to data exfiltration, malware propagation, or unauthorized access.
The analytic detects the creation, modification, or enabling of scheduled tasks that execute commands using native Windows shells (PowerShell, Cmd, Wscript, Cscript) or from public folders (Users, Temp, ProgramData). This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment.
The following analytic identifies the creation or deletion of scheduled tasks using the schtasks.exe utility with the -create or -delete flags. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it can indicate unauthorized system manipulation or malicious intent, often associated with threat actors like Dragonfly and incidents such as the SUNBURST attack. If confirmed malicious, this activity could allow attackers to execute code, escalate privileges, or persist within the environment, posing a significant security risk.
The analytic detects the creation of scheduled tasks in Windows using `schtasks.exe` with the `/xml` or `-xml` parameter. This activity is significant as it is a common technique for establishing persistence or achieving privilege escalation, often used by malware like Trickbot and Winter-Vivern. While creating a scheduled task via XML may be legitimate, it can also be abused by attackers. If confirmed malicious, this could allow attackers to maintain access, execute additional payloads, and potentially lead to data theft or ransomware deployment.
The analytic identifies the creation of scheduled tasks that execute binaries or scripts from public directories, such as Users\Public, ProgramData, or Windows\Temp, using schtasks.exe with the /create command. This activity often indicates an attempt to maintain persistence or execute malicious scripts, which are common tactics in malware deployment. If confirmed as malicious, this could lead to data compromise, unauthorized access, and potential lateral movement within the network.
The following analytic detects the creation, modification, or enabling of scheduled tasks with known suspicious or malicious task names. It leverages Windows Security EventCode 4698, 4700, and 4702 to identify when such tasks are registered, modified, or enabled. This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment.
The analytic detects the creation of scheduled tasks within user-writable paths using Windows Security EventCode 4698. It identifies tasks registered via schtasks.exe or TaskService that execute commands from directories like Public, ProgramData, Temp, and AppData. This behavior is significant as it may indicate an attempt to establish persistence or execute unauthorized commands. If confirmed malicious, an attacker could maintain long-term access, escalate privileges, or execute arbitrary code, posing a severe threat to system integrity and security.
Detects the creation of a scheduled task that launches an executable from a non-standard, writable directory, which subsequently loads a co-located DLL. This pattern is a form of DLL Sideloading used for persistence and was observed in a ToddyCat APT attack.
Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE
Detects remote task creation via at.exe or API interacting with ATSVC namedpipe
Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale
Detects the creation of a scheduled task named "MicrosoftsUpdate" which is used to execute a malicious batch file as part of the HrServ web shell infection chain.
Detects the creation of a scheduled task by a process named 'lsassa.exe', a .NET backdoor used by Lunar Spider. The malware masquerades as the legitimate 'lsass.exe' process and establishes persistence by creating a task that runs on startup.
Detects the creation of a scheduled task designed to run with SYSTEM privileges and terminate common AV/EDR processes. This technique is used by kkRAT for persistence and defense evasion.
This rule detects activities associated with the SmartLoader malware, including the creation or renaming of specific files (ODE3.exe, Module.class, Lua51.dll) in suspicious user application data directories, the creation or update of scheduled tasks with a specific name ("SecurityHealthService_ODE3"), and the DLL sideloading of "lua51.dll". These activities indicate potential execution, persistence, and defense evasion by the SmartLoader malware.
This rule detects XWorm persistence mechanisms. It looks for the creation of scheduled tasks, registry run keys, or startup folder shortcuts that execute suspicious payloads from the AppData\Roaming directory. The malware is known to use filenames like "WmiPrvSE.exe" (masquerading as a legitimate system file) and "Soundman.exe").
Detects various activities associated with the AppSuite PDF Editor backdoor, a trojanized application with extensive backdoor capabilities. This rule looks for specific command-line execution, persistence mechanisms, and network communications.
Detects a combination of suspicious activities often associated with the LummaC2 stealer. This includes querying the 'Run' registry key for reconnaissance and creating a scheduled task for persistence, often named "Update" and set to run on logon.
The following analytic detects the creation of a Scheduled Task with a high entropy, randomly generated name, leveraging Event ID 4698. It uses the `ut_shannon` function from the URL ToolBox Splunk application to measure the entropy of the Task Name. This activity is significant as adversaries often use randomly named Scheduled Tasks for lateral movement and remote code execution, employing tools like Impacket or CrackMapExec. If confirmed malicious, this could allow attackers to execute arbitrary code remotely, potentially leading to further compromise and persistence within the network.
Page 47 of 51