Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,212 detections
Filters
Last updated
All Time
Detection languages
509
326
77
74
65
Contributors
296
180
163
99
82
Categories
875
790
434
154
126
Platforms
1,196
17
13
6
5
Products / Services
443
331
276
228
118
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,212
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
KQL detects suspicious child processes launched by PHP or web-server workers following possible exploitation of CVE-2026-109618 or CVE-2026-109619.
Detects malicious file hashes, suspicious process executions involving Node.js/Bun running setup scripts, schtasks/powershell persistence monitoring tasks, and connections to known domains/RPC endpoints associated with threat activity. The query ran without errors in a live tenant.
Detects an executable running from the C:\Windows\ directory (excluding known benign applications) that establishes two or more distinct persistence mechanisms within a short timeframe, such as scheduled tasks, registry run keys, or startup folder shortcuts.
Detects the correlation of Registry Run key values for known utilities (Lightshot, Procmon, RuntimeBroker) pointing to paths in Program Files with a scheduled task creation of the same name on the same device within a 1-hour window.
Detects execution of a Python script named SysMon.py via a scheduled task, correlated with a subsequent network connection to ipinfo.io initiated by the same Python interpreter within a 10-minute window.
Detects PowerShell registering a logon scheduled task that executes a Trays.exe binary from an AppData Yandex Trays path with the -tray argument, or a scheduled task specifically named 'Microsoft apdate'. Associated with the RareWolf AnyDesk dropper batch script.
Detects potential C2Agent parent-spoofing behavior characterized by short-lived scheduled tasks (created and deleted within a 10-minute window with names matching c2a_<n>) or process relaunches carrying specific -fork2 command-line markers.
Detects the creation of a scheduled task named ChromeUpdate with highest privileges on logon, initiated from a process running within the user AppData\Local\Temp directory.
Detects a sequence where a SharePoint application pool worker process (w3wp.exe) spawns a command shell (cmd.exe, powershell.exe, pwsh.exe) related to SharePoint, followed shortly (within 1 hour) by high-fidelity lateral movement tooling or remote execution techniques (such as PsExec, WMI, PowerShell remoting, or scheduled tasks) on the same host.
Detects the creation of scheduled tasks using schtasks.exe or PowerShell that execute SysMon.py from the non-standard C:\Windows\SystemHealth\Update\ directory, or the corresponding scheduled task creation events.
Detects an executable running from the C:\Windows\ directory (excluding known benign applications) that establishes two or more distinct persistence mechanisms within a short timeframe, such as scheduled tasks, registry run keys, or startup folder shortcuts.
Detects the creation of a Windows scheduled task with the name or command containing 'WinRTCS' correlated with WMI permanent event subscription activities or execution of the 'own_lib.ps1' watchdog script within a 1-hour window on the same device, using Microsoft Defender XDR tables.
Detects when the same initiating process stops or deletes Windows services and subsequently deletes scheduled tasks or WMI event subscriptions within a 15-minute window on a single device, potentially indicating defense evasion or clean-up actions.
Detects persistence mechanisms established via Registry Run/RunOnce keys, Startup folder modifications, or scheduled task creation using specific tool names such as client32 or pcictlui.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
Detects creation of a scheduled task named "Windows Defender Advanced
Threat Protection Service" configured to run at system startup with SYSTEM privileges
and launch an executable named defender.exe. HoneyMyte (Mustang Panda) used this exact
schtasks command to establish boot persistence for the CoolClient backdoor sideloader,
masquerading the task and binary as a legitimate Windows Defender component.
Threat Protection Service" configured to run at system startup with SYSTEM privileges
and launch an executable named defender.exe. HoneyMyte (Mustang Panda) used this exact
schtasks command to establish boot persistence for the CoolClient backdoor sideloader,
masquerading the task and binary as a legitimate Windows Defender component.
Detects the default scheduled task activity of the hacktool Defendnot, which is used to disable Windows Defender Security.
It abuses Microsoft's undocumented WSC API to register itself as a fake antivirus product, allowing it to disable Windows Defender.
During installation, Defendnot creates a scheduled task named 'defendnot' with the argument '--from-autorun' for persistence.
It abuses Microsoft's undocumented WSC API to register itself as a fake antivirus product, allowing it to disable Windows Defender.
During installation, Defendnot creates a scheduled task named 'defendnot' with the argument '--from-autorun' for persistence.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
Detects hosts exhibiting multiple persistence mechanisms (Run keys, Scheduled Tasks, and Windows Services) within a short timeframe, indicating potential adversary persistence setup.
Detects the creation of persistence artifacts associated with the 'gh-token-monitor' service utilized by the Shai-Hulud worm across Linux systemd user services, macOS LaunchAgents, and Windows scheduled tasks or local application directories. This service acts as a dead-man's switch designed to wipe the user's home directory if the stolen GitHub token is revoked.
Detects scheduled task creation observed through ADAudit Plus. Scheduled tasks are a
long-standing persistence and remote execution mechanism, and seeing them at the
directory audit layer catches creation across the domain rather than host by host.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='TASK_CREATED'
| groupby user, object, commandline, domain
long-standing persistence and remote execution mechanism, and seeing them at the
directory audit layer catches creation across the domain rather than host by host.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='TASK_CREATED'
| groupby user, object, commandline, domain
Page 1 of 58