Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,212 detections
Filters
Last updated
All Time
Detection languages
509
326
77
74
65
Contributors
296
180
163
99
82
Categories
875
790
434
154
126
Platforms
1,196
17
13
6
5
Products / Services
443
331
276
228
118
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,212
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Campaign converting compromised FortiGate firewalls into credential stealers
Detects the creation of a scheduled task via schtasks.exe identified by the specific command-line string associated with 'CrysomeLoader', configured to execute every 5 minutes.
Detects the creation of suspicious scheduled tasks using the 'schtasks.exe' utility. The rule flags tasks that are created from suspicious paths (e.g., Temp, ProgramData), tasks executing common script extensions (vbs, ps1, bat, hta, js), or tasks that masquerade as legitimate Windows or System update tasks.
This rule detects the creation of Windows services or scheduled tasks that reference known file paths, names, or command-line indicators associated with the Turb00 loader, HijackLoader, SnappyClient, or Vidar malware families. It utilizes Windows Event logs (4697/4698) and Sysmon process creation events to identify persistence mechanisms being established by these threats.
Detects the creation of scheduled tasks using the Windows schtasks utility, specifically looking for common adversarial naming conventions or patterns such as 'MiniJunk' or recursive task names, often used to establish persistence.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility where the command line contains the specific strings 'MiniJunk' or 'MiniBrowse'. This pattern is often associated with the installation or persistence mechanisms of specific malicious software.
Detects the creation of scheduled tasks using schtasks.exe by processes that are not digitally signed by Microsoft Corporation, as well as the loading of taskschd.dll by non-standard/unsigned processes. This behavior is indicative of potential persistence mechanisms or unauthorized task scheduling activity.
Detects unauthorized child process creation by the Windows Error Reporting Manager (wermgr.exe). The rule identifies scenarios where wermgr.exe, executed under the SYSTEM context via the QueueReporting scheduled task (often abused in the RoguePlanet exploit chain), spawns interactive shells or command processors like cmd.exe, powershell.exe, or cscript.exe. Legitimate instances of wermgr.exe do not spawn interactive user interfaces or shells.
Detects creation of scheduled tasks followed by execution of pcalua.exe on the same endpoint. This combination was observed by Huntress during RedCurl intrusions and is uncommon in legitimate enterprise activity.
Detects a persistent loading pattern attributed to the Kimsuky threat group. The rule monitors for the creation of a hidden scheduled task named 'Edge Updater' that triggers a wscript.exe process executing a disguised VBScript file named with an 'OfficeUpdater' naming convention. This detection covers both the task registration (Event ID 4698) and the subsequent execution of the malicious script via wscript.exe.
Detects the process Crisp.exe creating a legacy AT-style scheduled task job file in the C:\Windows\Tasks directory while simultaneously loading mstask.dll. This behavior is indicative of persistence establishment, specifically associated with the Operation Turb00 HijackLoader sideloading chain which utilizes legacy task scheduling to re-execute AlphVector.exe.
Detects the abuse of the Windows Error Reporting (WER) service mechanism, specifically targeting the 'QueueReporting' scheduled task. Attackers may employ junction-based path redirection to execute a malicious wermgr.exe binary located outside of the standard system directory. The rule identifies instances where wermgr.exe is running from non-standard locations, or running at SYSTEM integrity level spawned by standard task-related parent processes, which indicates a potential privilege escalation or persistence attempt (linked to CVE-2026-50656).
Detects instances where wermgr.exe, typically used for Windows Error Reporting (WER), spawns interactive command-line interfaces such as cmd.exe, powershell.exe, or others. This behavior is indicative of exploitation (such as CVE-2026-50656) where an attacker has redirected a scheduled task to execute malicious code under SYSTEM integrity, masquerading as the wermgr.exe process.
Identifies the loader cementing persistence by creating a scheduled task that executes the RMM payload upon user logon or system start. Specifically looks for 'schtasks.exe' creating a task with a name that is not alphanumeric and a task run command pointing to an executable in the AppData directory.
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
Detects unauthorized execution of wermgr.exe from suspicious paths or spawned by Task Scheduler service (svchost.exe/taskeng.exe) with non-standard parent processes. This behavior is indicative of privilege escalation attempts where an unprivileged process leverages the Windows Error Reporting (WER) QueueReporting scheduled task to execute a malicious payload in the context of the SYSTEM account.
This rule detects the creation of a scheduled task, either via schtasks.exe or Event ID 4698, where the task content points to a suspicious, user-writable directory (e.g., Temp, AppData). It correlates this activity with the presence of known Loader/Stealer process indicators (HijackLoader/Vidar) occurring within a 15-minute window on the same host, indicating likely persistence establishment by malicious software.
Detects specific persistence artifacts associated with LARP53RAT, including unauthorized file shortcuts in the Startup folder, modifications to RunOnce registry keys for system recovery, and suspicious scheduled task creation masquerading as Microsoft Edge updates.
Detects execution of wermgr.exe from suspicious, non-standard directories (such as temp or user-writable paths). This behavior is indicative of the 'RoguePlanet' exploit, which leverages a junction swap to replace the legitimate Windows Error Reporting binary with a malicious payload, executed via the WER QueueReporting scheduled task.
Detects the creation of Windows scheduled tasks using 'schtasks.exe' where the executable being registered or the task itself is associated with suspicious directories like %LOCALAPPDATA%, %APPDATA%, or %TEMP%. The rule further filters for specific suspicious strings often used in malicious task configurations, indicating potential persistence or malicious command execution.
Detects signs of persistence via suspicious scheduled task creation or local user creation/group escalation, and C2 activity involving a specific IP address or unauthorized connections to the Telegram bot API.
Page 23 of 58