Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,212 detections
Filters
Last updated
All Time
Detection languages
509
326
77
74
65
Contributors
296
180
163
99
82
Categories
875
790
434
154
126
Platforms
1,196
17
13
6
5
Products / Services
443
331
276
228
118
MITRE Techniques
18,115
15,635
12,577
8,388
6,215
1,212
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Clipboard hijacking malware for cryptocurrency address substitution
Open-source derived remote access trojan with plugin architecture
Commodity .NET keylogger and remote access trojan
macOS malware used by JINX-0164 against cryptocurrency developers
Commodity .NET keylogger and remote access trojan
This rule detects the creation of a scheduled task using 'schtasks.exe' that involves suspicious filenames or paths, specifically focusing on components associated with QEMU, database files, or known suspicious executables. It further highlights tasks created with high-privilege context (SYSTEM or highest integrity level) or those configured to trigger on system-level events (logon, start, idle), which are common indicators of persistence mechanisms used by attackers.
Detects specific suspicious behaviors associated with the Payouts King ransomware. It monitors for indirect command execution where cmd.exe is spawned by non-shell processes to programmatically execute schtasks, or the direct invocation of schtasks.exe to execute tasks hidden within paths mimicking Mozilla-related directories for persistence.
Detects the creation of scheduled tasks by decompression utilities or Office applications. This behavior is indicative of a dropper technique where malicious artifacts extracted from archives or spawned by Office documents establish persistence. The rule specifically monitors schtasks.exe command lines that target user-writable directories or involve rundll32-based execution, commonly used by the Obsidian Sandstorm/SilverGorilla threat actor activity.
Detects the creation of scheduled tasks using schtasks.exe that point to high-risk directories (Temp, AppData, ProgramData) or utilize obfuscated PowerShell commands (encoded parameters). This behavior is often associated with adversary persistence or initial execution.
Detects scheduled tasks created with embedded PowerShell XOR decoding logic, ReadAllBytes, and Invoke-Expression techniques that may be used to establish persistence and execute obfuscated payloads. The rule specifically looks for 'schtasks.exe' creating a task with '/create', containing 'OneDrive', 'Startup', 'Task' in the command line, and also includes '-bxor', 'ReadAllBytes', 'iex', and '[Text.Encoding]::UTF8.GetBytes' which are indicative of obfuscated PowerShell execution via XOR decoding.
Detects execution of 'schtasks.exe' spawned by 'ConfigurationRemotingServer.exe'. This pattern is often associated with remote management or administrative tasks, but can be leveraged by adversaries to establish persistence or remote execution.
Detects instances where ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe are observed spawning schtasks.exe, powershell.exe, or pwsh.exe with command line arguments indicative of creating or registering a scheduled task. This behavior is highly irregular for these system binaries and may indicate an adversary attempting to achieve persistence by masquerading or exploiting legitimate Windows management components.
Detects persistence establishment via the Windows Package Manager (WinGet) Desired State Configuration (DSC) engine. The rule identifies instances where 'ConfigurationRemotingServer.exe' or 'WindowsPackageManagerServer.exe' spawns 'schtasks.exe' or uses PowerShell to create scheduled tasks. It correlates process execution events with Security Event ID 4698 to identify unauthorized scheduled task creation within the WinGet DSC context.
Detects instances where the ConfigurationRemotingServer.exe process spawns tools like schtasks.exe, powershell.exe, or pwsh.exe to create a scheduled task. This behavior is indicative of an attacker abusing the WinGet configuration management (DSC) engine, specifically via the 'winget configure' mechanism, to establish persistence by triggering the creation of a new scheduled task through a DSC script resource.
Detects the execution of 'schtasks.exe' spawned by 'ConfigurationRemotingServer.exe'. This pattern is indicative of persistent scheduled task creation being orchestrated through the abuse of WinGet Desired State Configuration (DSC) resource management capabilities.
Detects a suspicious sequence where DllHost.exe writes an executable or script to a common public directory (such as C:\Users\Public\, C:\Windows\Temp\, or C:\ProgramData\), followed by the execution of that file within 30 minutes by a system process (svchost.exe or services.exe), often indicative of a scheduled task or service-based persistence mechanism.
Detects the Amadey loader malware attempting to establish persistence via Windows Scheduled Tasks. The rule monitors for the execution of schtasks.exe with parameters creating a task that points to suspicious user-writable directories (Temp, AppData) or known Amadey-related artifacts such as the 'e079729711' staging path or 'nudwee.exe' binary.
Detects execution of schtasks.exe initiated by common scripting languages (wscript, cscript, powershell, pwsh) or execution involving files within the ProgramData directory, which are frequent indicators of malicious activity related to persistence or automated task manipulation.
This rule detects the creation or configuration of a scheduled task named 'GoogleErrorReport' which references 'Fondue.exe' located in the 'C:\Users\Public' directory. This specific pattern is associated with 'Dropping Elephant' malware persistence, where the task ensures the binary executes persistently on the host.
Detects the installation of the Kazuar backdoor, indicated by the creation of a scheduled task or service, following initial access via stolen credentials. This detection correlates suspicious persistence mechanisms with a remote session login on a host previously identified with StealC activity, suggesting a multi-stage attack where initial compromise (StealC) leads to credential theft, followed by remote access and persistence (Kazuar).
This rule detects the creation or registration of scheduled tasks that involve the 'PerfWatson2.exe' utility or execution paths originating from within the local AppData directory. These patterns are often associated with persistence mechanisms used by malware or malicious scripts to maintain execution after reboots.
Page 33 of 58