Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,212 detections
Filters
Last updated
All Time
Detection languages
509
326
77
74
65
Contributors
296
180
163
99
82
Categories
875
790
434
154
126
Platforms
1,196
17
13
6
5
Products / Services
443
331
276
228
118
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,212
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
This rule detects potential persistence mechanisms by monitoring the creation of scheduled tasks using the 'schtasks' utility or modifications to Windows Registry 'Run' keys, specifically targeting suspicious paths (AppData, Temp, or ProgramData). The detection logic correlates these suspicious persistence artifacts with network activity by joining the events with Sysmon Event ID 3 (Network connection) to identify hosts communicating over common C2-associated ports (4000, 4001, 4002, 443) to non-private IP addresses. A risk score is calculated based on the presence of these persistence markers and outbound network connections.
This rule detects the creation of scheduled tasks that point to executable files located in suspicious directories such as ProgramData, Temp, or AppData. This behavior is indicative of persistence mechanisms commonly employed by the The Gentlemen Ransomware-as-a-Service (RaaS) group to maintain access and execute malicious components like backdoors or ransomware binaries.
Detects the creation of a Windows scheduled task via 'schtasks.exe' that specifically involves the 'MasterPackager.Updater' and execution of a 'script.vbs' file. This behavior is indicative of potential software deployment or persistence mechanisms utilizing VBScript within a scheduled task.
Form-grabbing and credential stealing malware-as-a-service
Ransomware group exploiting edge devices and managed file transfer software
Ransomware group exploiting edge devices and managed file transfer software
Detects potential malicious persistence mechanisms (scheduled tasks, WMI event subscriptions, or Registry Run keys) initiated by Python executables or PyInstaller-bundled processes. This behavior is associated with information stealers that use these methods to maintain presence on a compromised host.
Detects potential privilege escalation activity including manual privilege discovery using 'whoami /priv', suspicious elevated processes spawned from non-elevated parents, and specific scheduled task execution patterns associated with Payouts King malware.
Detects the creation of scheduled tasks that involve QEMU virtualization binaries or virtual disk images. This activity is associated with the GOLD ENCOUNTER threat group and campaigns STAC4713/STAC3725, which utilize QEMU to facilitate persistence and infrastructure defense evasion by maintaining virtualized environments across system reboots.
This rule detects the creation of scheduled tasks using either schtasks.exe or PowerShell (Register-ScheduledTask) that exhibit high-risk indicators. These indicators include executing files from suspicious locations (AppData, Temp, or specific user-writable directories), the use of encoded PowerShell commands, or initiation by common remote access tools (sshd, ssh, or mstsc). This behavior is often associated with persistence mechanisms used by adversaries.
This rule detects the creation or registration of scheduled tasks that involve the 'PerfWatson2.exe' utility or execution paths originating from within the local AppData directory. These patterns are often associated with persistence mechanisms used by malware or malicious scripts to maintain execution after reboots.
This rule detects the creation of scheduled tasks (Event ID 4697) where the command line contains either 'System' or 'Admin'. This could indicate an attempt to create a scheduled task that runs with elevated privileges or impersonates system/admin accounts for persistence or privilege escalation.
Detects the creation of a scheduled task where the action references an executable file located in common user-writable directories (ProgramData, AppData, Users\Public, or Temp) shortly after that file was created on the disk. This pattern is characteristic of persistence mechanisms used by threat actors associated with Operation Turb00, such as the Wingo or HijackLoader malware families, which use scheduled tasks to maintain persistence via dropped binaries.
Detects the Operation Turb00 SnappyClient delivery and persistence mechanism, characterized by the execution of a malicious AlphVector.exe process that loads a trojanized opera_elf.dll and WebView2Loader.dll. The rule also identifies the creation of specific persistence artifacts, including a legacy Task Scheduler 1.0 .job file named 'socket_dispatcher_v2.job' in the Windows Tasks directory and a malicious shortcut 'prompt_analyzer_debug.lnk' within the user Startup folder.
Detects the creation of a scheduled task named 'OneDriveHealth', which is associated with APT28 activity. This task is used for persistence via COM hijacking; it executes 60 seconds after registration, kills and restarts explorer.exe to facilitate the loading of a hijacked COM object, and subsequently removes itself.
Detects the creation of a Windows scheduled task that attempts to execute a VMware-related binary (vmwared.exe) under the guise of 'MicrosoftEdgeUpdate' on system logon with the highest privileges. This behavior is indicative of a persistence mechanism attempt.
Detects the creation of scheduled tasks using schtasks.exe or at.exe where the command line contains suspicious indicators such as execution from AppData/Temp directories, use of LOLBins (rundll32, regsvr32, powershell), encoded commands, or suspicious command-line patterns, specifically when the initiating process is not signed by Microsoft.
Detects malicious activities associated with The Gentlemen RaaS group, specifically targeting GPO modifications to distribute ransomware, disable Windows Defender Real-time Monitoring, and deploy persistence mechanisms via scheduled tasks in SYSVOL or NETLOGON paths.
Detects the creation of scheduled tasks by known Mustang Panda DLL sideloading hosts, specifically Solid PDF Creator or Citrix Receiver components. This rule identifies persistence mechanisms likely established during the post-compromise phase of espionage operations.
Detects the creation of scheduled tasks using schtasks.exe where the task involves paths often associated with user-writable directories (ProgramData, AppData, Temp) and specific suspicious keywords. This behavior is common for adversaries seeking persistence by scheduling execution of potentially malicious payloads located in non-standard or user-writable locations.
Detects the creation of a scheduled task named 'RageGuard' using the Windows schtasks.exe utility. This behavior is indicative of the TrymeLocker malware attempting to maintain persistence on a compromised system by executing with highest privileges upon user logon.
Page 25 of 58