Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
108 detections
Filters
Last updated
All Time
Detection languages
55
20
12
7
5
Contributors
20
19
15
15
11
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
82
23
3
1
1
Products / Services
36
21
19
19
9
MITRE Techniques
97
95
70
68
23
IDS Classtypes
3
IDS Protocols
3
Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities. This rule specifically looks for `schtasks.exe` being used with the `/Change`, `/TN`, and `/disable` arguments, targeting important system tasks like BitLocker, ExploitGuard, SystemRestore, UpdateOrchestrator, Windows Defender, WindowsBackup, and WindowsUpdate.
Detects updates to scheduled tasks (EventID 4702) where the new task content (`TaskContentNew`) contains suspicious keywords. These keywords include common temporary or user-writable directories often used by malware for staging or execution, combined with suspicious commands or scripting interpreters. This rule aims to identify adversaries establishing persistence or executing malicious code via scheduled tasks.
Detects update to a scheduled task event that contain suspicious keywords.
Page 6 of 6