Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,212 detections
Filters
Last updated
All Time
Detection languages
509
326
77
74
65
Contributors
296
180
163
99
82
Categories
875
790
434
154
126
Platforms
1,196
17
13
6
5
Products / Services
443
331
276
228
118
MITRE Techniques
18,115
15,635
12,577
8,388
6,215
1,212
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Identifies the execution of a process with 'VirtualSmokestGuy666' in its command line, which is indicative of CastleRAT Build 666 establishing persistence. This specific string suggests a scheduled task or similar mechanism used by the malware to maintain its presence on the system.
Detects potential persistence mechanisms associated with SharkLoader or similar malware campaigns. The rule monitors for unauthorized modification of Windows Run registry keys by non-Microsoft signed processes, the creation of suspicious scheduled tasks masquerading as legitimate update tasks (e.g., OneDrive or Microsoft updates), and the execution of processes from common malware working directories like 'AppData/Roaming/xwreg' or 'AppData/Roaming/xgdf'.
Detects the creation of a scheduled task named 'RageGuard' or containing 'RageGuard' in its command line, often associated with TrymeLocker malware. The rule monitors for Task Scheduler Event IDs 4698 and 106, as well as schtasks process command line arguments used to create such tasks.
Detects the creation or modification of scheduled tasks that either utilize user-writable directories (e.g., AppData, Temp) for task execution or mimic the naming convention of 'OneDrive Standalone Update' tasks. This behavior is indicative of persistence mechanisms used by the StrikeShark campaign to deploy SharkLoader and related payloads, such as Cobalt Strike.
Detects the creation of a scheduled task named 'RageGuard' correlated with commands known to inhibit system recovery, such as modifying boot configuration with bcdedit or deleting volume shadow copies/backups using vssadmin or wbadmin, within the same process execution chain.
This rule detects potential malicious activity by tracking the aggregation of multiple distinct persistence mechanisms on a single host. It triggers when a single process is associated with at least four unique types of persistence-related events, such as scheduled task registration, startup folder file creation, registry run key updates, Winlogon configuration changes, IFEO modifications, or service registration.
Detects the unauthorized deletion of cmd.exe from System32 or SysWOW64 by a non-system process, correlated with the creation of a new service or scheduled task on the same host within 60 seconds, which is characteristic of TrymeLocker malware persistence and tampering.
This rule detects the creation or modification of scheduled tasks using utilities like schtasks.exe or at.exe that are followed by the execution of script-based interpreters (PowerShell, CMD, or WScript). This pattern is commonly indicative of an attacker establishing persistence by scheduling malicious scripts to run automatically.
Identifies the creation or execution of a scheduled task named 'GoogleErrorReport', which is used by the threat group Dropping Elephant (also known as Patchwork or FIN13) to run their side-loading chain every minute. This rule detects both the command-line invocation of schtasks.exe to create or modify tasks and the Windows Security Event ID 4698 for scheduled task creation, specifically looking for the 'GoogleErrorReport' string.
Detects the execution of executables with specific names ("WinHealth.exe", "WindowsSecurity.exe") known to be dropped by the SonicCrypt crypter. The execution is often initiated by the Task Scheduler, resulting in a parent process of 'taskhostw.exe'.
Detects the creation of a scheduled task by the Potemkin Loader using the 'schtasks.exe' utility. The rule specifically looks for command lines containing task creation flags combined with an executable path located within 'AppData' directories, which is a common persistence mechanism for this loader.
Correlates the fake VPN installer creating a scheduled task pointing to the high-entropy AppData directory to ensure the stealer runs on boot.
Detects the creation of scheduled tasks using 'schtasks.exe' with names that mimic legitimate Microsoft services such as 'RealtekAudio', 'CoreUIComponents', 'OneDriveHealthTask', or 'WindowsUpdate'. This technique is often used by adversaries for persistence.
Detects the creation of scheduled tasks using schtasks.exe that masquerade as common update tasks (Google, Microsoft) or point to suspicious file paths often associated with malware (e.g., C:\ProgramData\VMware\). The rule monitors for tasks created with high privileges or triggers, which are indicative of persistence mechanisms.
Detects the creation of scheduled tasks that masquerade as legitimate update processes (e.g., Microsoft Edge, Google Updater) using elevated privileges (/rl highest) and triggering on system logon (/sc onlogon). The rule specifically flags tasks associated with suspicious paths or binary names like VMWare or PerfWatson to identify potential persistence or execution mechanisms.
Detects the execution of a scheduled task named OneDriveHealth invoking taskkill on explorer.exe to trigger a hijacked COM object. This rule specifically looks for 'svchost.exe' as the initiating process, executing 'taskkill' with 'explorer.exe' in its command line, which is indicative of a specific attack chain involving scheduled tasks and process termination.
Detects the creation of a scheduled task used by NarwhalRAT for persistence, using a specific task name and execution pattern.
Detects the creation of scheduled tasks using schtasks.exe with suspicious command-line patterns, specifically those containing encoded commands or specific strings related to Windows system components (WindowsColorSystem, Calibration). This technique is often used by adversaries to establish persistence or facilitate execution of malicious payloads.
Detects the creation of scheduled tasks using specific Mozilla-related naming patterns ('\Mozilla\UpdateTask' or '\Mozilla\ElevateTask') that execute with SYSTEM privileges, a behavior associated with Payouts King ransomware persistence mechanisms.
Detects the creation of suspicious scheduled tasks used by the StrikeShark campaign for persistence. These tasks are named with a prefix mimicking OneDrive updates ('OneDrive Standalone Update Task-S-1-') and are configured to execute SystemSettings.exe from specific AppData subdirectories ('xwreg' or 'xgdf'). The rule correlates process execution logs and scheduled task creation events to identify the dropper activity.
Identifies the creation of a scheduled task using 'schtasks.exe' where the initiating process is a Bomgar executable (bomgar-rep.exe or bomgar-scc.exe). This behavior is indicative of an attacker establishing persistence after exploiting a Bomgar vulnerability.
Page 36 of 58