Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
159 detections
Filters
Last updated
All Time
Detection languages
60
53
11
9
8
Contributors
33
24
20
17
15
Categories
100
100
95
12
10
Platforms
159
4
1
Products / Services
45
28
27
27
20
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
CVEs
1
IDS Classtypes
6
IDS Protocols
6
Identifies the creation or execution of a scheduled task named 'GoogleErrorReport', which is used by the threat group Dropping Elephant (also known as Patchwork or FIN13) to run their side-loading chain every minute. This rule detects both the command-line invocation of schtasks.exe to create or modify tasks and the Windows Security Event ID 4698 for scheduled task creation, specifically looking for the 'GoogleErrorReport' string.
Detects the creation of a specific scheduled task named 'WindowsSecurityUpdate' using 'schtasks.exe' in conjunction with network communication to 'azurewebsites.net'. This activity is indicative of the MiniUpdate malware, associated with the Iranian APT group 'Screening Serpens', attempting to establish persistent access.
This rule correlates the creation of .config files (often used for EDR evasion via AppDomainManager bypass) with the immediate creation of scheduled tasks using schtasks.exe. This sequence of events suggests an adversary is attempting to establish persistence after an initial evasion technique.
Detects a deceptive scheduled task named 'MicrosoftEdgeUpdate' executing PowerShell Net.WebClient download cradles. This rule specifically looks for the creation of a scheduled task using 'schtasks.exe' that includes 'MicrosoftEdgeUpdate' in its name and 'Net.WebClient' in its command line, indicating an attempt to download content using PowerShell's WebClient object, potentially for malicious purposes.
Detects the creation of both 'UpdateSystem' and 'UpdateUser' scheduled tasks on the same device within a ten-minute window, a distinctive persistence pattern associated with the Gentlemen Ransomware.
Detects manual or programmatic triggering of the Windows Error Reporting 'QueueReporting' scheduled task. The RoguePlanet exploit abuses this task to execute an overwritten wermgr.exe binary as SYSTEM. This rule identifies execution via 'schtasks.exe /run' command line or via COM API calls reflected in Task Scheduler Operational logs.
Detects schtasks creating a one-time task on another host using supplied credentials and a batch file under Windows Temp, executed as SYSTEM. This behavior is indicative of an adversary establishing persistence or lateral movement by scheduling malicious code to run with high privileges on a remote system.
This rule detects the creation or modification of scheduled tasks that launch executables from the Windows Fonts directory with SYSTEM-level persistence. It specifically looks for `schtasks` or `powershell` commands that include patterns indicative of an executable in the Fonts directory and a startup trigger (e.g., 'onstart', 'atstartup', '/ru system'). The XQL view provides actor and causality fields for investigation.
This rule detects a highly complex correlation where a web server process (w3wp.exe) drops a file named 'install-persistent.php' and then, within one hour, 'schtasks.exe' executes a command that includes 'install-persistent.php'. This pattern is indicative of a web shell being dropped and then scheduled for execution, potentially as part of a supply chain compromise.
Udm Task Fonts Startup
YARA-L
Targets the startup task behaviour that launches a Fonts-hosted executable with SYSTEM-level persistence. The UDM rule retains principal and target context for correlation.
Udm Task Fonts Startup
YARA-L
Targets the startup task behaviour that launches a Fonts-hosted executable with SYSTEM-level persistence. The UDM rule retains principal and target context for correlation.
Detects if schtasks is modifying an existing XenoUpdateManager task, indicating payload updating, as observed in Operation XENOFISCAL.
This rule detects potential lateral movement activities by monitoring for the execution of 'psexec', 'wmiexec', or 'schtasks' commands within a short timeframe on the same computer. A count of 2 or more such command executions within an hour is flagged as suspicious, indicating potential adversary activity.
Detects the creation or modification of a scheduled task named 'OneDrive Update', which is known to be used by the BLUERABBIT backdoor for persistence. The rule looks for Windows Security Events (EventID 4698 for task creation, 4702 for task modification) and process execution events where command lines contain 'OneDrive Update' along with scheduled task registration utilities like 'Register-ScheduledTask', 'New-ScheduledTask', or 'schtasks'.
This rule detects attempts to modify the Zoom update scheduled task using `schtasks.exe /change`. This activity is indicative of potential scheduled task hijacking, as legitimate Zoom updaters typically do not use this command to modify their own tasks. The detection specifically looks for command lines containing both `/change` and `ZoomUpdateTaskUser-`.
This rule detects the creation of scheduled tasks using `schtasks.exe` or `at.exe` with specific command-line arguments (`/create`, `/tn`, and either `/ru` or `/tr`). It then correlates these process events with registry events related to Task Scheduler keys or values containing "Task" to identify potential persistence mechanisms.
Detects the creation of a scheduled task named 'SystemUpdate' using 'schtasks.exe', which is a persistence mechanism observed in the Phantom Bot malware distributed via malicious npm packages. The rule specifically looks for the 'create' action and the 'SystemUpdate' task name in the command line.
Detects the creation of scheduled tasks using an XML file located in a temporary directory, a technique used by DesckVB for stealthy persistence.
Detects creation of scheduled tasks followed by execution of pcalua.exe on the same endpoint. This combination was observed by Huntress during RedCurl intrusions and is uncommon in legitimate enterprise activity.
This rule detects the creation of scheduled tasks using `schtasks.exe` or `at.exe` with specific command-line arguments (`/create`, `/tn`, and either `/ru` or `/tr`). It then correlates these process events with registry events related to Task Scheduler keys or values containing "Task" to identify potential persistence mechanisms.
Matanbuchus 3.0 Scheduled Task Creation
Cortex XDR
This rule detects the creation of a scheduled task named 'Update Tracker Task' using either 'schtasks.exe' or PowerShell cmdlets ('Register-ScheduledTask', 'New-ScheduledTask'). This specific task name has been associated with the Matanbuchus 3.0 loader.
Page 3 of 8