Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,212 detections
Filters
Last updated
All Time
Detection languages
509
326
77
74
65
Contributors
296
180
163
99
82
Categories
875
790
434
154
126
Platforms
1,196
17
13
6
5
Products / Services
443
331
276
228
118
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,212
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Detects schtasks.exe creating a scheduled task named "Windows Defender Advanced Threat Protection Service" that launches defender.exe (a renamed Sangfor executable abused for DLL sideloading) with SYSTEM privileges at startup. This is the exact persistence mechanism HoneyMyte (Mustang Panda) uses to relaunch the CoolClient backdoor chain from the fake "Microsoft\Windows Defender" directory on every boot.
The following analytic detects a .wer file being written into the Windows Error Reporting ReportQueue directory by a process other than the standard error-reporting binaries.
Windows Error Reporting normally populates ReportQueue only through werfault.exe, werfaultsecure.exe, or wermgr.exe following an actual application crash.
In the ShieldBreak exploit, the attacker fabricates a .wer report directly and manually invokes the QueueReporting scheduled task, which causes wermgr.exe to process the report and load an attacker-planted phantom DLL at SYSTEM integrity.
If confirmed malicious, this activity indicates preparation for a local privilege escalation attempt abusing Windows Error Reporting.
Windows Error Reporting normally populates ReportQueue only through werfault.exe, werfaultsecure.exe, or wermgr.exe following an actual application crash.
In the ShieldBreak exploit, the attacker fabricates a .wer report directly and manually invokes the QueueReporting scheduled task, which causes wermgr.exe to process the report and load an attacker-planted phantom DLL at SYSTEM integrity.
If confirmed malicious, this activity indicates preparation for a local privilege escalation attempt abusing Windows Error Reporting.
Detects the creation of a scheduled task using the schtasks.exe utility designed to run with SYSTEM privileges upon system startup. This behavior is often associated with persistence mechanisms where an adversary attempts to maintain long-term access by ensuring malicious code executes automatically with high privileges whenever the system boots.
Detects scheduled-task persistence launching masqueraded defender.exe/Sang.exe with SYSTEM privileges at startup, outside legitimate Windows Defender/Sangfor install paths.
Detects potential persistence mechanisms involving 'IBM SPSS WinWrap Basic IDE' or 'WinWrapIDE.exe'. The rule monitors for the creation of a scheduled task, registry run key additions, or event ID 4698 (scheduled task creation) associated with these artifacts. It further correlates these activities with suspicious account creation events (Event IDs 4720, 4732) on the same device within a one-hour window.
Detects a security-software presence check (360 Total Security/eScan process names) followed within 10 minutes by a persistence-establishing event from the same parent process.
Detects potential persistence mechanisms involving 'IBM SPSS WinWrap Basic IDE' or 'WinWrapIDE.exe'. The rule monitors for the creation of a scheduled task, registry run key additions, or event ID 4698 (scheduled task creation) associated with these artifacts. It further correlates these activities with suspicious account creation events (Event IDs 4720, 4732) on the same device within a one-hour window.
Detects process self-deletion (executable, scheduled task, or install directory) correlated within 60 minutes to a matching prior creation event, indicating post-execution cleanup behavior consistent with loader/RAT install-then-delete patterns such as those used by DOUBLECUP-delivered payloads.
Detects anomalous scheduled task execution by identifying processes named 'csvchost.exe' or 'psvchost.exe' that reference GoogleUpdateService or MSEdgeUpdateService task names containing GUID patterns. It further correlates this with suspicious command-line indicators such as 'App.py' references, 'WakeToRun' flags, '-headless' flags, or PowerShell bypass techniques, which are associated with the delivery of CountLoader and DeviceManager RATs in DOUBLECUP campaigns.
Detects the creation of a scheduled task named 'MicroUpdaterV1' using the 'schtasks.exe' utility with an XML configuration file ('t.xml') that specifies 'pythonw.exe' as the task target. This behavior is associated with the persistence mechanism of the DeviceManager RAT as delivered by the DOUBLECUP loader.
Detects the creation of scheduled tasks using specific naming patterns (GoogleUpdateService or MSEdgeUpdateService followed by a GUID) often associated with the CountLoader malware. This technique attempts to masquerade as legitimate Google or Microsoft Edge update processes to establish persistence.
Detects DeviceManager creating a scheduled task named MicroUpdaterV1 via schtasks.exe /Create /F from a %TEMP%\t.xml definition, followed by pythonw.exe execution, consistent with DeviceManager's persistence mechanism that re-runs every 10 minutes.
Detects recreation of svchost32/Cloud Sync Service persistence (registry Run key, Windows service, or scheduled task) within 15 minutes of removal, indicative of CornFlake backdoor re-installation following remediation.
Detects CountLoader creating a scheduled task named GoogleUpdateService<GUID> via the Schedule.Service COM object to run an embedded Python environment (App.py) every 25 minutes, masquerading as a legitimate Google Update task.
Detects redundant persistence mechanisms associated with the CornFlake RAT by identifying the creation of Windows services, registry run keys, and scheduled tasks that reference a binary named svchost32.exe located outside of the standard C:\Windows\System32 directory, often masquerading as a 'Cloud Sync Service'.
Correlates deletion of a scheduled task via the Schedule.Service COM object within an hour of creation of a suspiciously-named task (GoogleUpdateService, MSEdgeUpdateService, or MicroUpdaterV1), consistent with CountLoader's forensic-evidence cleanup command.
Detects the creation of scheduled tasks using names specifically identified in the Larva-24009 (HeptaX) campaign. These task names spoof legitimate Intel and Google Update tasks to establish persistence for a PowerShell-based backdoor, allowing the attacker to evade detection by mimicking common software update processes.
Detects a pattern where a process enumerates running processes via tasklist looking for msedge.exe with SHELL32.dll or CoreUIComponents.dll modules loaded, followed within 5 minutes by a taskkill /F /PID command against that process, initiated by svchost.exe, taskeng.exe, python.exe, pythonw.exe, powershell.exe, or a process invoked via native_host.py. This behavior matches Edgecution's technique of detecting a running headless Edge instance and terminating it before relaunching, as observed in the UNC6692 campaign.
Detects the execution of Microsoft Edge (msedge.exe) with suspicious command-line arguments designed to sideload malicious browser extensions, often associated with the UNC6692 campaign. The rule specifically looks for a combination of flags including --load-extension, headless/no-startup-window modes, known malicious or suspicious paths (e.g., 'User Data\test1'), and the disabling of browser synchronization or the first-run experience, occasionally triggered by scheduled tasks.
Detects the creation of a scheduled task named 'WindowsUpdate' or 'BootUpdate' that triggers the execution of 'fsociety.exe' with SYSTEM privileges. This pattern is indicative of the TOKYOCORE malware establishing persistence on a Windows host.
Larva-24009 HeptaX C2 beacon to shared infrastructure (get-command/index/new-upload/post_proc)
Page 20 of 58