Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,212 detections
Filters
Last updated
All Time
Detection languages
509
326
77
74
65
Contributors
296
180
163
99
82
Categories
875
790
434
154
126
Platforms
1,196
17
13
6
5
Products / Services
443
331
276
228
118
MITRE Techniques
18,115
15,635
12,577
8,388
6,215
1,212
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Detects the establishment of persistence via Registry Run keys, Scheduled Tasks, or Windows Services, where the executed file or binary path is located in suspicious directories such as AppData, Temp, or ProgramData. This indicates potentially malicious code staged in temporary or user-writable locations to maintain access.
Detects persistence mechanisms associated with the SHARDLOADER malware family, including the creation of suspicious scheduled tasks and modification of registry run keys. The rule monitors processes, scheduled task events, and registry value changes for specific indicators such as paths in C:\ProgramData\IDM\logs\, files named 'pcl2bmp' or 'mediuminststart', and DLL sideloading patterns involving SolidPDFCreator.
Detects a batch or script artifact that creates a scheduled task named 'ApphostRagistreationVerifier' (a likely typo for 'ApphostRegistrationVerifier') which is configured to execute a file located within the 'Windows\Fonts\' directory. The detection specifically looks for the presence of 'schtasks' command, 'ONSTART' trigger, and 'SYSTEM' user context, indicating a persistent scheduled task.
Detects a persistence script querying for a missing task or payload and recreating it when absent, indicating self-repair behaviour. This rule specifically looks for command-line activity involving 'powershell', 'cmd', or 'schtasks.exe' that queries for scheduled tasks and then attempts to create or register them, often using keywords like 'if', 'missing', 'not found', 'create', or 'Register-ScheduledTask'.
This rule detects the creation or modification of a scheduled task that uses 'schtasks', 'powershell', or 'pwsh' to launch an executable from user-writable locations such as Temp, AppData, Public, or ProgramData. The command line specifically looks for references to 'adobe', 'acrobat', or 'onedrive' in conjunction with these user-writable paths, indicating potential abuse of legitimate software for persistence or execution of malicious code.
Detects the creation of a scheduled task using 'schtasks.exe' with specific command-line arguments that indicate an attempt to establish persistence. The rule looks for 'schtasks.exe' creating a task named 'Runtime Broker' that executes a program from a suspicious path within 'C:\ProgramData\Microsoft\Windows\Runtime\'. This pattern is often used by adversaries to maintain access to a system.
This rule detects the creation or registration of scheduled tasks that involve the 'PerfWatson2.exe' utility or execution paths originating from within the local AppData directory. These patterns are often associated with persistence mechanisms used by malware or malicious scripts to maintain execution after reboots.
Detects the deployment of the Kazuar backdoor, initiated by the Gamaredon group's PteroPaste loader. The rule monitors for a suspicious file creation event where a PowerShell or rundll32 process writes a DLL to a user-writable directory (AppData/Local or AppData/Roaming), followed immediately by the creation of a scheduled task (using schtasks) designed to trigger the execution of the dropped DLL via system binaries such as regsvr32, rundll32, or mshta.
Detects the creation of a scheduled task using the schtasks.exe utility with persistence-related triggers such as system startup or user logon. The rule excludes common trusted processes that frequently interact with the Task Scheduler to minimize false positives.
Detects the creation of a scheduled task using schtasks.exe where the command line includes indicators of potential script execution or remote command execution (cmd.exe, powershell.exe, wscript.exe, cscript.exe, or 'http'). This is a common pattern for persistence mechanisms involving staged payloads.
Detects the creation of a scheduled task using schtasks.exe where the command line includes indicators of potential script execution or remote command execution (cmd.exe, powershell.exe, wscript.exe, cscript.exe, or 'http'). This is a common pattern for persistence mechanisms involving staged payloads.
Detects instances where common Office applications or web browsers initiate the execution of schtasks.exe to create or modify scheduled tasks. This behavior is a common indicator of persistence mechanisms being established by malicious documents or browser-based exploits, excluding processes signed by Microsoft.
Detects instances where common Office applications or web browsers initiate the execution of schtasks.exe to create or modify scheduled tasks. This behavior is a common indicator of persistence mechanisms being established by malicious documents or browser-based exploits, excluding processes signed by Microsoft.
Detects the creation or modification of Windows scheduled tasks using Security Event IDs 4698 and 4702. This rule parses the event data to extract key task information such as task name, command, arguments, and the author of the task.
This rule detects various activities associated with the SilverFox loader chain, including Defender exclusion modifications, suspicious child processes spawned from trojanized OEM binaries, VirtuOne DLL loading, scheduled task creation with specific names or unusual principals, creation of 'checktime.vbs' in public user directories, and masquerading of 'svchost.exe' in the Windows directory.
Detects the creation of scheduled tasks from XML files in 'C:\Users\Public\Documents\' by 'schtasks.exe' and subsequent execution of JavaScript payloads via 'wscript.exe' or 'cscript.exe' from the same public documents directory. This activity is attributed to the CryptoBandits threat group.
This rule detects the creation of scheduled tasks using 'schtasks.exe' or Windows Security Event ID 4698, specifically looking for tasks configured to run with 'HighestAvailable' privileges or tasks that execute suspicious script files (sys.vbs, Thal.exe, wscript.exe, cscript.exe). This behavior can indicate an adversary establishing persistence or escalating privileges.
Detects a suspicious execution chain potentially associated with Deed RAT (used by Mustang Panda/Twill Typhoon), consisting of DLL sideloading by a legitimate signed executable followed by persistence mechanism creation (Registry Run keys or Scheduled Tasks) on the same host. Additionally, it identifies devices exhibiting repeated outbound connections to the same remote public IP over multiple days, serving as an indicator of potential re-compromise or persistent C2.
This rule correlates multiple suspicious activities indicative of ransomware or destructive attacks. It detects a combination of volume shadow copy deletion, bulk file modifications, creation of suspicious scheduled tasks, and network connections occurring during periods of high file write activity. The rule triggers when multiple signals are observed or when specific high-fidelity destructive indicators are present.
Detects potential persistence attempts on Windows systems where an unsigned executable, located in a user-writable directory (Temp, AppData, Downloads), is either configured for automatic startup via Registry run keys or registered as a scheduled task.
This rule detects potentially malicious lateral movement or persistence activities by monitoring the creation or modification of executable files in remote network shares and startup folders, as well as the use of administrative tools like sc.exe or schtasks.exe to create services or tasks. The rule specifically filters out processes signed by Microsoft, focusing on non-standard or unsigned binaries that perform these administrative actions across multiple instances, indicating potential automated lateral propagation.
Page 35 of 58