Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
159 detections
Filters
Last updated
All Time
Detection languages
60
53
11
9
8
Contributors
33
24
20
17
15
Categories
100
100
95
12
10
Platforms
159
4
1
Products / Services
45
28
27
27
20
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
6
IDS Protocols
6
Detects suspicious processes, including various shells and utilities, spawned by the WinRM host process (wsmprovhost.exe). This activity can indicate an adversary using WinRM for remote execution, potentially for initial access, persistence, or privilege escalation.
Detects the creation of a scheduled task using common command-line patterns associated with PowerSploit or Empire's default configurations. This rule specifically looks for `schtasks.exe` being executed by PowerShell with parameters indicative of task creation, including specific task names like 'Updater' and common scheduling triggers.
This rule detects the creation of scheduled tasks by monitoring specific registry key paths associated with the Windows Task Scheduler. Adversaries often use scheduled tasks for persistence, privilege escalation, or execution of malicious code. By observing modifications to these registry paths, the rule aims to identify when new scheduled tasks are being registered on a system.
This rule detects potentially suspicious child processes spawned by PowerShell. It specifically looks for PowerShell (powershell.exe, powershell_ise.exe, pwsh.exe) launching a set of common Windows utilities that can be abused for malicious purposes, such as 'bitsadmin.exe', 'certutil.exe', 'mshta.exe', 'regsvr32.exe', 'rundll32.exe', 'schtasks.exe', and 'wmic.exe'. The rule includes filters to reduce false positives, such as specific command lines for AWS Workspaces, certutil's '-verifystore' option, and common benign wmic queries.
Detects the creation of a scheduled task by monitoring file creation events in the standard Windows scheduled task directories. This rule specifically looks for new files being written to ':\Windows\System32\Tasks\', ':\Windows\SysWOW64\Tasks\', and ':\Windows\Tasks\', which are common locations for scheduled task definitions.
Detects the creation of ".xml" and ".txt" files in folders within the "\AppData\Roaming\Microsoft" directory by specific uncommon processes. This behavior is associated with Devil Bait malware samples and stages as described by the NCSC.
Detects when adversaries delete important scheduled tasks using `schtasks.exe` to disrupt system functionality or security mechanisms. The rule specifically targets the deletion of tasks related to critical Windows components like BitLocker, ExploitGuard, SystemRestore, UpdateOrchestrator, Windows Defender, WindowsBackup, and WindowsUpdate, which can indicate an attempt to disable or interfere with essential system services or security features.
Detects Windows command lines that miss a space before or after the /c or /k flag when running a command using cmd.exe. This could indicate an attempt at command obfuscation or a typo. The rule specifically looks for patterns like 'cmd.exe/c', '\cmd/c', '"cmd/c', and similar for /k and /r, as well as specific commands like '/cwhoami', '/cpowershell', etc., where the space is missing. It filters out common false positives related to VS Code and specific command line endings.
Detects the usage of 'schtasks.exe' with the '/delete' flag and the '/tn *' argument, which is used to delete all scheduled tasks on a local Windows system, including those created by other users. This activity can be indicative of an adversary attempting to disrupt system operations or remove forensic evidence.
Detects the use of stordiag.exe, a legitimate Windows utility, to execute other system binaries like schtasks.exe, systeminfo.exe, and fltmc.exe. This behavior can be indicative of an adversary attempting to bypass defenses by proxying execution through a trusted binary, a technique often associated with System Binary Proxy Execution (T1218). The rule specifically filters out executions where stordiag.exe is launched from its default system paths to reduce false positives, focusing on instances where it might be copied or used from non-standard locations.
Detects the creation of scheduled tasks by user accounts using the 'schtasks.exe' utility. This rule specifically looks for the execution of 'schtasks.exe' with the '/create' command-line argument, while filtering out activity from common system users to reduce false positives.
Detects the creation of a schtask via PowerSploit or Empire Default Configuration.
Page 8 of 8