Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,212 detections
Filters
Last updated
All Time
Detection languages
509
326
77
74
65
Contributors
296
180
163
99
82
Categories
875
790
434
154
126
Platforms
1,196
17
13
6
5
Products / Services
443
331
276
228
118
MITRE Techniques
18,115
15,635
12,577
8,388
6,215
1,212
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
This rule detects potential persistence attempts by monitoring for the execution of 'schtasks.exe' with the '/create' flag or the loading of 'taskschd.dll' by suspicious parent processes. These parents include script interpreters (e.g., powershell, wscript), Microsoft Office applications, and various living-off-the-land binaries or web-related utilities, which are commonly abused by adversaries to establish persistence via the Windows Task Scheduler.
Detects the creation of a specific scheduled task named 'WindowsSecurityUpdate' using 'schtasks.exe' in conjunction with network communication to 'azurewebsites.net'. This activity is indicative of the MiniUpdate malware, associated with the Iranian APT group 'Screening Serpens', attempting to establish persistent access.
Identifies the creation of scheduled tasks for Windows System Health Monitor persistence, specifically looking for 'schtasks.exe' creating tasks with names like 'Windows System Health Monitor' or 'Windows System Health Check', in conjunction with 'RuntimeHost.exe' activity. This pattern is indicative of cryptojacking campaigns abusing ScreenConnect.
This rule correlates the creation of .config files (often used for EDR evasion via AppDomainManager bypass) with the immediate creation of scheduled tasks using schtasks.exe. This sequence of events suggests an adversary is attempting to establish persistence after an initial evasion technique.
Detects persistence mechanisms associated with 'Operation Poisson', specifically focusing on the creation of a scheduled task named 'TaskAdmin1' with highest privileges that launches 'wscript.exe' with 'sys.vbs' at logon, or the use of Registry Run keys to achieve similar persistence with 'sys.vbs'. It also detects the execution of 'wscript.exe' with 'sys.vbs'.
Detects the creation of scheduled tasks using schtasks.exe that exhibit suspicious characteristics. This includes tasks referencing external URLs, those containing base64-encoded or obfuscated command strings, and tasks pointing to binaries or scripts in user-writable paths (e.g., AppData, Temp). The rule specifically targets tasks intended to run with SYSTEM privileges or those using common persistence triggers, while excluding known legitimate administrative software.
Detects the creation of scheduled tasks (schtasks.exe) spawned by common scripting or social engineering-related parent processes (PowerShell, Cmd, WScript, MSHTA). The rule specifically looks for payloads associated with common attack patterns, such as downloading remote content or executing encoded commands, which indicates potential persistence or payload delivery activities.
Detects a deceptive scheduled task named 'MicrosoftEdgeUpdate' executing PowerShell Net.WebClient download cradles. This rule specifically looks for the creation of a scheduled task using 'schtasks.exe' that includes 'MicrosoftEdgeUpdate' in its name and 'Net.WebClient' in its command line, indicating an attempt to download content using PowerShell's WebClient object, potentially for malicious purposes.
Detects scheduled tasks named "CheckRealtekAudioVersion" or "RealtekAudioEnhancements64" created for AsyncRAT persistence. This rule specifically looks for the execution of 'schtasks.exe' with the '/create' argument and the presence of these specific task names in the command line, which are known indicators of AsyncRAT establishing persistence.
Detects the creation of both 'UpdateSystem' and 'UpdateUser' scheduled tasks on the same device within a ten-minute window, a distinctive persistence pattern associated with the Gentlemen Ransomware.
Identifies the creation of scheduled tasks masquerading as Realtek audio services for persistence, often associated with AsyncRAT.
Detects manual or programmatic triggering of the Windows Error Reporting 'QueueReporting' scheduled task. The RoguePlanet exploit abuses this task to execute an overwritten wermgr.exe binary as SYSTEM. This rule identifies execution via 'schtasks.exe /run' command line or via COM API calls reflected in Task Scheduler Operational logs.
Detects schtasks creating a one-time task on another host using supplied credentials and a batch file under Windows Temp, executed as SYSTEM. This behavior is indicative of an adversary establishing persistence or lateral movement by scheduling malicious code to run with high privileges on a remote system.
This rule detects the creation or modification of scheduled tasks that launch executables from the Windows Fonts directory with SYSTEM-level persistence. It specifically looks for `schtasks` or `powershell` commands that include patterns indicative of an executable in the Fonts directory and a startup trigger (e.g., 'onstart', 'atstartup', '/ru system'). The XQL view provides actor and causality fields for investigation.
Identifies the creation of the BackupCheck scheduled task designed to repeatedly trigger the setup.exe doit sideload chain, associated with the Nimbus Manticore threat actor.
Detects the creation of a scheduled task using 'schtasks' with 'SYSTEM' privileges, masquerading as Adobe or OneDrive, and pointing to an executable in a user-writable path (Temp, AppData, ProgramData, or Users\Public). This pattern is often used by adversaries for persistence or privilege escalation.
This rule detects a highly complex correlation where a web server process (w3wp.exe) drops a file named 'install-persistent.php' and then, within one hour, 'schtasks.exe' executes a command that includes 'install-persistent.php'. This pattern is indicative of a web shell being dropped and then scheduled for execution, potentially as part of a supply chain compromise.
Detects schtasks.exe establishing persistence using task names that spoof legitimate Windows services. This rule specifically looks for the creation of scheduled tasks via 'schtasks.exe /create' command line that include task names such as 'Synchronize OS', 'Windows System Health', 'BackupCheck', or 'WindowsSecurityUpdate', which are commonly used by adversaries to blend in with legitimate system tasks.
Detects creation of persistence tasks executing XML payloads.
Detection of scheduled tasks like DiskDiagnosticDataCollector created by GammaWorm to launch ADS payloads.
This rule detects the creation of scheduled tasks or 'at' jobs initiated by VBScript engines (wscript.exe or cscript.exe). This behavior can be indicative of malicious activity, such as persistence mechanisms established by malware or phishing attacks that leverage VBScript to schedule future execution.
Page 37 of 58