Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,212 detections
Filters
Last updated
All Time
Detection languages
509
326
77
74
65
Contributors
296
180
163
99
82
Categories
875
790
434
154
126
Platforms
1,196
17
13
6
5
Products / Services
443
331
276
228
118
MITRE Techniques
18,115
15,635
12,577
8,388
6,215
1,212
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Detects the creation of specific scheduled tasks associated with LoaderClient or WeedHack malware. These tasks, named 'JMonitoringTask' or 'JavaSecurityUpdater', are used for persistence and recurring execution of malicious code.
Detects the creation of scheduled tasks using schtasks.exe that run at logon with highest privileges, specifically targeting known update or system binaries which may indicate malicious persistence or masquerading techniques.
This rule detects the creation or configuration of a scheduled task named 'GoogleErrorReport' which references 'Fondue.exe' located in the 'C:\Users\Public' directory. This specific pattern is associated with 'Dropping Elephant' malware persistence, where the task ensures the binary executes persistently on the host.
Detects evidence of the TinyRCT backdoor, which masquerades as legitimate VMware utilities and system binaries. The rule monitors for malicious activity including suspicious execution of vmtools.exe/vmwared.exe from ProgramData, unauthorized scheduled task creation, PerfWatson2.exe execution outside of legitimate Visual Studio installation paths, and chrome_setup.exe execution from non-standard directories.
Detects the creation of scheduled tasks using schtasks.exe that point to the ProgramData directory, which is a common persistence location for malware like SystemBC. The rule excludes common, benign software installers and updaters that frequently use this directory to avoid false positives.
This rule monitors for patterns associated with the Gamaredon (ACTINIUM) threat group's PowerShell loaders (e.g., Ptero-family) and the Kazuar backdoor. It specifically detects indicators such as malicious PowerShell command lines, NTFS alternate data stream manipulation, and suspicious scheduled task creation.
This rule detects the creation of a scheduled task using 'schtasks.exe' that includes a PowerShell command with 'invoke-expression' (iex) and 'invoke-restmethod' (irm) to ensure persistence across reboots. This behavior is characteristic of the DeepLoad malware, often delivered via ClickFix campaigns.
Detects the creation of scheduled tasks using 'schtasks.exe' with command line arguments that indicate suspicious activity. This includes tasks created in common temporary or user-writable directories, or tasks that involve PowerShell with encoded commands or obfuscated strings, which are often used by adversaries for persistence or execution.
Detects the creation of a scheduled task via schtasks.exe that executes a command interpreter or script engine (e.g., PowerShell, cmd, wscript) where the parent process is not signed by Microsoft. This behavior is often associated with the execution of malicious payloads, persistence mechanisms, or lateral movement.
This rule detects potential persistence attempts by monitoring for the execution of 'schtasks.exe' with the '/create' flag or the loading of 'taskschd.dll' by suspicious parent processes. These parents include script interpreters (e.g., powershell, wscript), Microsoft Office applications, and various living-off-the-land binaries or web-related utilities, which are commonly abused by adversaries to establish persistence via the Windows Task Scheduler.
This rule identifies the Potemkin Loader establishing persistence by creating a scheduled task. The scheduled task is configured to execute a Remote Monitoring and Management (RMM) payload upon user logon or system startup. Detection is based on `schtasks.exe` command-line arguments that include `/create`, `/tn` (task name), and `/tr` (task run) pointing to an executable within an `AppData` directory.
Detects the creation of scheduled tasks using schtasks.exe, where the command line arguments reference known LOLBins (Living Off the Land Binaries) such as certutil, regsvr32, mshta, wscript, cscript, rundll32, or encoded command execution via cmd.exe. This activity often indicates an attempt to establish persistence or execute malicious code using trusted system binaries.
This rule identifies the Potemkin Loader establishing persistence by creating a scheduled task. The scheduled task is configured to execute a Remote Monitoring and Management (RMM) payload upon user logon or system startup. Detection is based on `schtasks.exe` command-line arguments that include `/create`, `/tn` (task name), and `/tr` (task run) pointing to an executable within an AppData directory.
Detects potential persistence activity associated with LegionLoader by monitoring for the execution of an MSI installer from user-writable directories (e.g., AppData, Temp), followed by the creation of a scheduled task via schtasks.exe, and the creation of files within the AppData\Roaming directory within a 5-minute window.
This rule monitors for the creation of scheduled tasks using the Windows 'schtasks.exe' utility that contain command-line strings associated with BeepRAT malware activity. Specifically, it identifies task names or configurations used for persistence or payload execution, such as 'WindowsUpdateTempFileCleanUp', 'TCC\\config.ini.c', 'HFY.exe', and various TCC loader arguments.
Detects the use of the 'schtasks.exe' utility with command line arguments containing strings associated with suspicious activity or known malicious patterns, such as file cleanup or configuration manipulation, often used for persistence or stealthy execution.
Detects indicators of the BeepRAT malware (associated with Operation DragonClone), including specific process execution patterns of HFY.exe, LuaJit.exe, or tcc.exe, network connections to known C2 infrastructure on port 18848, keylogger file creation, and malicious task scheduling or TCC loader execution techniques.
Detects the creation of scheduled tasks using schtasks.exe with command-line arguments that contain suspicious file names, paths, or flags often associated with malicious behavior, such as persistence mechanisms or potential lateral movement tools.
Detects the creation of scheduled tasks using 'schtasks.exe' with command-line arguments containing specific patterns such as 'WindowsUpdateTempFileCleanUp', 'config.ini.c', 'SchTask_x86', or 'SchTask_x64'. These patterns are often associated with the deployment of malicious persistence mechanisms or software execution.
Detects evidence of SystemBC (Coroxy) malware persistence, characterized by the creation of a scheduled task using 'schtasks.exe' that executes a random binary residing in '%ProgramData%' with a 'start' argument, coupled with concurrent modifications to the Windows 'Run' registry keys in a persistent path.
Detects behavioral indicators of the SystemBC (Coroxy) malware, including suspicious task scheduling, hidden PowerShell relaunch routines, use of staging binary names, and anomalous svchost.exe injection patterns. This rule focuses on detecting the multi-stage persistence and proxy behavior typical of SystemBC in pre-ransomware intrusion chains.
Page 34 of 58