Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
116 detections
Filters
Last updated
All Time
Detection languages
67
18
14
7
5
Contributors
30
27
14
12
8
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
101
20
2
2
1
Products / Services
41
26
18
15
15
MITRE Techniques
110
101
81
50
27
CVEs
5
1
1
IDS Classtypes
1
IDS Protocols
1
Detects execution of a Python script named SysMon.py via a scheduled task, correlated with a subsequent network connection to ipinfo.io initiated by the same Python interpreter within a 10-minute window.
Detects post-exploitation activities associated with FortiMail vulnerability CVE-2026-104286 (FG-IR-26-175). The rule identifies potential unauthorized persistence and data exfiltration, including the creation or modification of archive accounts with remote destinations, execution of 'migadmin' via root cron, and specific admin logout anomalies.
The following analytic detects potential malicious activities involving PowerShell's task scheduling cmdlets. It leverages PowerShell Script Block Logging (EventCode 4104) to identify unusual or suspicious use of cmdlets like 'New-ScheduledTask' and 'Set-ScheduledTask'. This activity is significant as attackers often use these cmdlets for persistence and remote execution of malicious code. If confirmed malicious, this could allow attackers to maintain access, deliver additional payloads, or execute ransomware, leading to data theft or other severe impacts. Immediate investigation and mitigation are crucial to prevent further compromise.
The following analytic detects the use of 'schtasks.exe' to start a Scheduled Task on a remote endpoint. This detection leverages Endpoint Detection and Response (EDR) data, focusing on process details such as process name, parent process, and command-line executions. This activity is significant as adversaries often abuse Task Scheduler for lateral movement and remote code execution. If confirmed malicious, this behavior could allow attackers to execute arbitrary code remotely, potentially leading to further compromise of the network.
Detects the execution of control.exe with suspicious command-line arguments involving WebDAV paths (DavWWWRoot) and file extensions like .cpl or .dll, initiated by Windows task-related processes (svchost, taskeng, schtasks). This pattern is indicative of potential malicious payload loading or proxy execution where a scheduled task is used to trigger a secondary malicious component.
Detects a suspicious execution sequence associated with the SectopRAT loader. The rule monitors for ReportDump.exe being launched from a ProgramData directory by common scheduling or service host processes, followed immediately by the loading of a malicious sdkcra.dll library.
Detects the execution of control.exe with suspicious command-line arguments involving WebDAV paths (DavWWWRoot) and file extensions like .cpl or .dll, initiated by Windows task-related processes (svchost, taskeng, schtasks). This pattern is indicative of potential malicious payload loading or proxy execution where a scheduled task is used to trigger a secondary malicious component.
Detects a suspicious execution sequence associated with the SectopRAT loader. The rule monitors for ReportDump.exe being launched from a ProgramData directory by common scheduling or service host processes, followed immediately by the loading of a malicious sdkcra.dll library.
Detects persistence mechanisms associated with the CARBONATO botnet. The rule identifies two primary behaviors: the execution of a hidden watchdog binary '/usr/local/bin/.docker-network-monitor' by the cron daemon, and the use of 'chattr +i' to make this watchdog binary immutable, preventing deletion or modification.
Detects the execution of control.exe with suspicious command-line arguments involving WebDAV paths (DavWWWRoot) and file extensions like .cpl or .dll, initiated by Windows task-related processes (svchost, taskeng, schtasks). This pattern is indicative of potential malicious payload loading or proxy execution where a scheduled task is used to trigger a secondary malicious component.
Detects the execution of control.exe with suspicious command-line arguments involving WebDAV paths (DavWWWRoot) and file extensions like .cpl or .dll, initiated by Windows task-related processes (svchost, taskeng, schtasks). This pattern is indicative of potential malicious payload loading or proxy execution where a scheduled task is used to trigger a secondary malicious component.
Detects the execution of control.exe with suspicious command-line arguments involving WebDAV paths (DavWWWRoot) and file extensions like .cpl or .dll, initiated by Windows task-related processes (svchost, taskeng, schtasks). This pattern is indicative of potential malicious payload loading or proxy execution where a scheduled task is used to trigger a secondary malicious component.
Detects a low-privileged account manually triggering the 'CreateObjectTask' scheduled task, which is a known technique to force the 'Shell Create Object Handler' (dllhost.exe) to start under the SYSTEM context. This behavior is often associated with pre-exploitation steps for privilege escalation vulnerabilities, specifically those involving OBJREF marshaling targeting specific COM objects.
This rule detects unauthorized or anomalous file modifications or creations to machine learning training datasets (e.g., fine-tuning data, training corpora) by users not belonging to the authorized data engineering group, occurring within one hour of a scheduled training or fine-tuning job execution. This behavioral pattern is indicative of potential data poisoning, where an adversary attempts to inject malicious data into the training set to bias or compromise the resulting model.
Detects the VelvetCake malware installation and operational pattern, which utilizes a scheduled task named 'OneDriveUpdateScheduler' to execute PowerShell scripts ('update1.ps1' or 'update2.ps1'). These scripts periodically retrieve modules or payloads from external infrastructure, specifically hardcoded C2 IPs or a dedicated GitHub repository.
Detects suspicious behavior where an identical executable (same path and SHA256) is launched twice within a short window (60 minutes) following a system reboot, utilizing two distinct persistence methods: one triggered via the Task Scheduler (under svchost.exe -k netsvcs) and one via a user logon autostart mechanism (spawned by explorer.exe).
This rule detects potential privilege escalation exploiting a dangling COM object registration (CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}). It monitors for a non-SYSTEM user creating a DLL within the 'CrossDevice' ProgramData folder, followed by a scheduled task trigger, and subsequently detects 'dllhost.exe' running as SYSTEM loading that specific malicious DLL, indicating successful execution of unauthorized code with elevated privileges.
Detects a suspicious execution sequence associated with the SectopRAT loader. The rule monitors for ReportDump.exe being launched from a ProgramData directory by common scheduling or service host processes, followed immediately by the loading of a malicious sdkcra.dll library.
Detects the creation or execution of a scheduled task named 'CreateObjectTask' via schtasks or PowerShell, which is associated with spawning 'dllhost.exe' as a child process under high-privileged parent processes (svchost, taskeng, or schtasks). This behavior is indicative of potential COM hijacking or privilege escalation techniques leveraging system tasks.
Detects a low-privileged account manually triggering the 'CreateObjectTask' scheduled task, which is a known technique to force the 'Shell Create Object Handler' (dllhost.exe) to start under the SYSTEM context. This behavior is often associated with pre-exploitation steps for privilege escalation vulnerabilities, specifically those involving OBJREF marshaling targeting specific COM objects.
Detects instances where PowerShell scripts are executed via the Windows Task Scheduler from within potential staging directories (ProgramData with randomized folder names). The rule identifies execution that uses common PowerShell obfuscation flags (e.g., -EncodedCommand) and requires secondary hardening bypass flags (e.g., -WindowStyle hidden), followed by correlated network activity to a specific suspicious C2 domain.
Page 1 of 6