Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40 detections
Filters
Last updated
All Time
Detection languages
17
9
8
2
2
Contributors
14
7
6
5
4
Categories
25
17
15
6
3
Platforms
32
9
3
Products / Services
13
11
6
6
4
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
1
IDS Protocols
1
1
Detects the creation of scheduled tasks on remote hosts by monitoring for the NetrJobAdd function call (opnum 0) against the ATSVC RPC interface (UUID: 1FF70682-0A51-30E8-076D-740BE8CEE98B). This interface is associated with the legacy Windows AT scheduler, which is frequently abused by offensive security tools like Impacket's atexec for remote command execution and lateral movement.
The following analytic detects the execution of the "At" application in Linux, which can be used by attackers to create persistence entries on a compromised host. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent process names associated with "at" or "atd". This activity is significant because the "At" application can be exploited to maintain unauthorized access or deliver additional malicious payloads. If confirmed malicious, this behavior could lead to data theft, ransomware attacks, or other severe consequences. Immediate investigation is required to determine the legitimacy of the execution and mitigate potential risks.
Detects the creation of scheduled tasks (Windows), cron jobs (Linux), or systemd timers where the initiating process is a common scripting or runtime interpreter (e.g., Python, Node.js, PowerShell, Java). This activity is often indicative of persistence mechanisms being established by a compromised agent or script-based process.
Detects the creation of scheduled tasks (Windows), cron jobs (Linux), or systemd timers where the initiating process is a common scripting or runtime interpreter (e.g., Python, Node.js, PowerShell, Java). This activity is often indicative of persistence mechanisms being established by a compromised agent or script-based process.
Detects creation of scheduled tasks for execution or persistence
Detects the creation of scheduled tasks (via schtasks.exe or at.exe) that include command-line arguments referencing virtualization artifacts (qemu, .qcow2, .vmdk, TPMProfiler) or specific database/dll files (vault.db, bisrv.dll). This pattern is often indicative of persistence mechanisms used by malware or threat actors to manage virtualized environments, exfiltrate data, or deploy components.
Detects use of scheduled tasks to break process trees and hide parent relationships
Detects the creation of scheduled tasks using schtasks.exe or at.exe by processes not signed by Microsoft. This behavior is often associated with adversary attempts to establish persistence by running code on a recurring basis or at specific times using native Windows utilities.
Detects the creation of scheduled tasks using schtasks.exe or at.exe by processes not signed by Microsoft. This behavior is often associated with adversary attempts to establish persistence by running code on a recurring basis or at specific times using native Windows utilities.
This rule detects the creation or modification of scheduled tasks using utilities like schtasks.exe or at.exe that are followed by the execution of script-based interpreters (PowerShell, CMD, or WScript). This pattern is commonly indicative of an attacker establishing persistence by scheduling malicious scripts to run automatically.
Detects AT job creation via SMB for remote scheduled execution
Detects the creation of scheduled tasks or command-line execution of task scheduling utilities (schtasks.exe, at.exe) that reference known SharkLoader persistence paths, file names, or task naming conventions.
This rule detects the creation of scheduled tasks or 'at' jobs initiated by VBScript engines (wscript.exe or cscript.exe). This behavior can be indicative of malicious activity, such as persistence mechanisms established by malware or phishing attacks that leverage VBScript to schedule future execution.
This rule detects the creation or modification of scheduled tasks using utilities like schtasks.exe or at.exe that are followed by the execution of script-based interpreters (PowerShell, CMD, or WScript). This pattern is commonly indicative of an attacker establishing persistence by scheduling malicious scripts to run automatically.
This rule detects the creation of scheduled tasks or 'at' jobs initiated by VBScript engines (wscript.exe or cscript.exe). This behavior can be indicative of malicious activity, such as persistence mechanisms established by malware or phishing attacks that leverage VBScript to schedule future execution.
Remote AT Job Scheduled via SMB
Suricata
This rule detects attempts to schedule a remote AT job via SMB. It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, containing the case-insensitive strings "atsvc" and "JobAdd". This combination indicates an attempt to use the AT service to add a scheduled task remotely, which can be a method for persistence or execution by attackers.
This rule detects attempts to execute AT commands via a web shell. It specifically looks for HTTP requests containing both 'at+' and 'cmd' in the URI, case-insensitively. This pattern is indicative of an attacker trying to run system commands through a compromised web application.
Detects the creation of remote scheduled tasks by monitoring access to the 'atsvc' named pipe over SMB. This activity is indicative of using tools like 'at.exe' or direct API calls to schedule tasks on a remote system, which can be leveraged for privilege escalation, execution, lateral movement, or persistence.
This rule detects the remote creation of scheduled tasks by monitoring access to the 'ATSVC' named pipe within the IPC$ share. Specifically, it looks for Event ID 5145, indicating a detailed file share access, where the ShareName is '\\*\IPC$', the RelativeTargetName is 'atsvc', and the AccessList contains 'WriteData'. This activity is characteristic of tools like 'at.exe' or direct API calls used to schedule tasks remotely.
Detects remote RPC calls to create or execute a scheduled task via the Advanced Telephony Service (ATSvc) interface. This activity can be indicative of lateral movement, privilege escalation, or persistence mechanisms used by adversaries.
This rule detects suspicious DCE-RPC function calls that indicate remote execution techniques on a Windows system. It specifically looks for operations related to scheduled tasks (JobAdd, SchRpcEnableTask, SchRpcRegisterTask, SchRpcRun), WMI execution (ExecMethod, ExecMethodAsync), and service creation/start (CreateServiceA/W, StartServiceA/W). These activities are commonly abused by adversaries for initial access, persistence, and lateral movement.
Page 1 of 2