Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
101 detections
Filters
Last updated
All Time
Detection languages
101
Contributors
36
24
19
13
6
Categories
45
34
24
23
23
Platforms
88
16
4
4
3
Products / Services
97
56
7
2
2
MITRE Techniques
39
25
17
17
14
CVEs
1
IDS Classtypes
1,937
503
461
381
236
101
IDS Protocols
43
41
8
3
2
ET INFO DYNAMIC_DNS Query to a *.freeddns .tokyo domain
ET INFO DYNAMIC_DNS Query to a *.itafricagroup .com domain
ET INFO DYNAMIC_DNS HTTP Request to a *.anchorchain .co .za domain
ET ATTACK_RESPONSE Nishang Invoke-PowerShellTcp Shell Prompt Outbound
ET INFO DYNAMIC_DNS HTTP Request to a *.freeddns .me domain
ET INFO DYNAMIC_DNS HTTP Request to a *.destroyerkisscover .com .br domain
This rule detects the presence of the PowerShell cmdlet 'Set-ScheduledTask' within the HTTP response body. This could indicate an attacker using a web-based mechanism to deliver or execute commands related to scheduled task creation or modification on a compromised system, potentially for persistence.
This rule detects the presence of the 'schtasks /query' command within the HTTP response body. This could indicate an attacker enumerating scheduled tasks on a compromised system, potentially as part of reconnaissance or lateral movement activities. The rule specifically looks for 'schtasks' and '/query' (case-insensitive) in HTTP responses with a 200 status code.
This rule detects the presence of the 'schtasks /create' command within the HTTP response body. This could indicate an adversary attempting to schedule tasks on a compromised system by delivering the command via an HTTP response, potentially for persistence or execution.
This rule detects the presence of the PowerShell cmdlet 'Start-ScheduledTask' within the HTTP response body. This could indicate an attacker attempting to establish persistence on a compromised system by creating scheduled tasks, potentially delivered via a web-based command and control channel or during an exploit.
This rule detects the presence of the PowerShell cmdlet 'Disable-ScheduledTask' within the HTTP response body. This could indicate an attacker attempting to disable scheduled tasks on a compromised system, potentially to remove persistence mechanisms or hinder forensic analysis. The rule specifically looks for a successful HTTP status code (200) and the 'disable-scheduledtask' string, optionally preceded by '-taskname' or '-taskpath'.
This rule detects the presence of the PowerShell cmdlet 'Enable-ScheduledTask' within the HTTP response body. This could indicate an attacker using a web server to deliver or instruct a client to enable a scheduled task, potentially for persistence or privilege escalation. The detection specifically looks for 'enable-scheduledtask' case-insensitively, optionally preceded by '-taskname' or '-taskpath', within a successful HTTP 200 OK response.
This rule detects the string "schtasks" followed by "/end" and then "/tn" within the HTTP response body. This pattern indicates that a client is receiving a response that contains a command to end a scheduled task using the `schtasks` utility. This could be part of a command-and-control communication or a lateral movement attempt where an adversary is managing scheduled tasks on a compromised system.
This rule detects the presence of 'schtasks' followed by '/delete' and '/tn' (task name) in the HTTP response body with a 200 status code. This could indicate an attacker attempting to delete scheduled tasks on a compromised Windows system, potentially to remove forensic evidence or disrupt legitimate operations. The detection is case-insensitive and uses a PCRE to match the specific command structure.
This rule detects the presence of the PowerShell cmdlet 'Register-ScheduledTask' within an HTTP response body. This could indicate an attacker attempting to establish persistence on a compromised system by creating a scheduled task, potentially delivered via a web-based command and control channel or a malicious download.
This rule detects the presence of the PowerShell cmdlet 'New-ScheduledTask' and related parameters ('-action', '-trigger', '-taskname', '-settings') within the HTTP response body. This could indicate a system receiving instructions to create a scheduled task, potentially for persistence or execution of malicious code. The detection specifically looks for successful HTTP status code 200 responses.
This rule detects HTTP responses (status code 200) that contain the string 'schtasks' followed by '/run' and '/tn' (case-insensitive) in the response body. This pattern indicates the potential for a client system to receive instructions to execute a scheduled task, which could be used for persistence, lateral movement, or other malicious activities.
Page 5 of 5