Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,212 detections
Filters
Last updated
All Time
Detection languages
509
326
77
74
65
Contributors
296
180
163
99
82
Categories
875
790
434
154
126
Platforms
1,196
17
13
6
5
Products / Services
443
331
276
228
118
MITRE Techniques
18,115
15,635
12,577
8,388
6,215
1,212
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Detects the creation of scheduled tasks using schtasks.exe where the task action executes a scripting engine or living-off-the-land binary (LOLBin). This behavior is often indicative of adversaries attempting to establish persistence or execute code using native system tools to evade detection.
This rule detects the creation or modification of scheduled tasks using utilities like schtasks.exe or at.exe that are followed by the execution of script-based interpreters (PowerShell, CMD, or WScript). This pattern is commonly indicative of an attacker establishing persistence by scheduling malicious scripts to run automatically.
This rule detects potential persistence mechanisms and execution associated with Amadey or StealC malware. It identifies the creation of scheduled tasks (`schtasks.exe /create`) targeting suspicious directories or known Amadey/StealC paths, as well as Task Scheduler Event ID 4698 (task created) referencing these paths. Additionally, it looks for direct execution of 'nudwee.exe' (an Amadey component) and shell processes (`cmd.exe`, `powershell.exe`) spawned by scheduled tasks from suspicious locations or referencing Amadey/StealC paths.
Detects the creation of scheduled tasks using the 'schtasks' utility, initiated by suspicious parent processes (browsers, scripting engines, or common tools) or utilizing suspicious task actions (PowerShell, VBScript, etc.) in user-writable directories. Additionally, it flags tasks with high-frequency scheduling or persistence triggers paired with encoded or hidden command-line arguments, which are common indicators of malicious activity such as malware execution or persistence mechanisms.
Detects a post-compromise reconnaissance burst associated with BeepRAT, where a process running from a suspicious directory (AppData, Temp, or ProgramData) executes five or more system discovery commands within a 60-second window, following the creation of a scheduled task on the same host.
Detects the BeepRAT malware using the Tiny C Compiler (tcc.exe) to execute shellcode directly from memory. The rule identifies TCC execution from non-standard directories (specifically within %LOCALAPPDATA%\TCC) using specific flags (-nostdlib -run), and correlates this activity with the creation of an elevated scheduled task named 'WindowsUpdateTempFileCleanUp' used for persistence.
This rule detects the creation of scheduled tasks or registry run keys that contain suspicious path indicators or specific file names often associated with persistence mechanisms. It monitors for the use of 'schtasks.exe' or 'at.exe' to create tasks referencing paths like ProgramData, Temp, AppData, or IDM\logs, as well as modifications to the 'Run' registry key with similar suspicious values.
Detects the creation of scheduled tasks using schtasks.exe that involve paths associated with staging (ProgramData, Temp, AppData) or are spawned by suspicious processes like Solid PDF Creator or MediumInstStart. This behavior is indicative of ransomware implant staging or persistence mechanisms used by threat actors.
Detects AT job creation via SMB for remote scheduled execution
This rule detects activities associated with the DRAYN malware, specifically the unauthorized modification of Discretionary Access Control Lists (DACLs) on MSP management platform directory archives using icacls, followed by the creation of a scheduled task to establish persistence.
Detects the creation of scheduled tasks using names associated with Microsoft Edge or Google update processes to achieve persistence. The rule specifically targets the deployment of known payloads like TinyRCT (vmwared.exe) or PerfWatson.exe at logon with highest privileges, masquerading as legitimate update tasks.
Detects the execution of the VNT tunneling tool disguised as a legitimate VMware executable (vmwared.exe) located in C:\ProgramData\VMware\. The rule also identifies the creation of a scheduled task named 'MicrosoftEdgeUpdate' configured to execute the masqueraded binary at user logon with elevated privileges.
Detects the creation, execution, or deletion of Windows scheduled tasks using 'Mozilla' task names (specifically '\Mozilla\UpdateTask' or '\Mozilla\ElevateTask'). The rule identifies tasks created with SYSTEM privileges and 'ONSTART' triggers via schtasks.exe, as well as associated administrative commands to run or delete these tasks, and correlates these with Security Event ID 4698.
Detects the creation of a scheduled task named 'SoftwareProtection' that executes a Python script. This technique is used by the CrashFix variant to establish persistence for its Python-based RAT, mimicking a legitimate Windows service to blend in. The detection specifically looks for the task name 'SoftwareProtection', a command line containing 'python.exe', 'pythonw.exe', or 'run.exe' along with 'udp.pyw', and the path '\windows\SoftwareProtectionPlatform\', indicating the malware's attempt to masquerade as a legitimate system component.
This rule detects the creation or configuration of a scheduled task named 'GoogleErrorReport' which references 'Fondue.exe' located in the 'C:\Users\Public' directory. This specific pattern is associated with 'Dropping Elephant' malware persistence, where the task ensures the binary executes persistently on the host.
This rule detects the creation of a scheduled task named 'WindowsVaultSyncService' either through the 'schtasks.exe' command-line utility or via 'ScheduledTaskCreated' device events. This specific task name, combined with a potentially misleading description, could indicate malicious activity attempting to establish persistence or execute code.
Detects the creation of a scheduled task using the schtasks.exe utility with persistence-related triggers such as system startup or user logon. The rule excludes common trusted processes that frequently interact with the Task Scheduler to minimize false positives.
This rule correlates multiple suspicious activities indicative of ransomware or destructive attacks. It detects a combination of volume shadow copy deletion, bulk file modifications, creation of suspicious scheduled tasks, and network connections occurring during periods of high file write activity. The rule triggers when multiple signals are observed or when specific high-fidelity destructive indicators are present.
Detects a suspicious execution chain potentially associated with Deed RAT (used by Mustang Panda/Twill Typhoon), consisting of DLL sideloading by a legitimate signed executable followed by persistence mechanism creation (Registry Run keys or Scheduled Tasks) on the same host. Additionally, it identifies devices exhibiting repeated outbound connections to the same remote public IP over multiple days, serving as an indicator of potential re-compromise or persistent C2.
Detects the creation of scheduled tasks using 'schtasks.exe' with command line arguments that indicate suspicious activity. This includes tasks created in common temporary or user-writable directories, or tasks that involve PowerShell with encoded commands or obfuscated strings, which are often used by adversaries for persistence or execution.
Detects the creation or modification of Windows scheduled tasks using Security Event IDs 4698 and 4702. This rule parses the event data to extract key task information such as task name, command, arguments, and the author of the task.
Page 30 of 58