Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,212 detections
Filters
Last updated
All Time
Detection languages
509
326
77
74
65
Contributors
296
180
163
99
82
Categories
875
790
434
154
126
Platforms
1,196
17
13
6
5
Products / Services
443
331
276
228
118
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,212
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Udm Task Fonts Startup
YARA-L
Targets the startup task behaviour that launches a Fonts-hosted executable with SYSTEM-level persistence. The UDM rule retains principal and target context for correlation.
Udm Task Fonts Startup
YARA-L
Targets the startup task behaviour that launches a Fonts-hosted executable with SYSTEM-level persistence. The UDM rule retains principal and target context for correlation.
Udm Mail Task Masquerade
YARA-L
Targets a scheduled task with trusted vendor wording whose action points to Temp, AppData, Public, or ProgramData. The UDM rule retains principal and target context for correlation.
Correlates the MiniJunk V2 persistence task with the execution of the renamed SoftwareLicencing.exe. This rule detects the creation of a scheduled task named "Synchronize OS" via schtasks.exe, and then correlates it with the execution of a file named "SoftwareLicencing.exe" on the same device. This behavior is indicative of the MiniJunk V2 malware used by the Screening Serpens APT group.
Identifies the creation or execution of a 'VirtualSmokestGuy' scheduled task, which is associated with CastleRAT for persistence. The rule specifically looks for command-line activity containing 'VirtualSmokestGuy' and excludes specific numerical strings to reduce false positives.
Identifies schtasks.exe creating persistence mechanisms configured with both logon and startup triggers simultaneously, a signature of the CheckRealtekAudioVersion task.
Detects schtasks.exe establishing persistence using task names that spoof legitimate Windows services (e.g., Synchronize OS, Windows System Health, BackupCheck, WindowsSecurityUpdate).
Detects the creation of scheduled tasks using `schtasks.exe` that include encoded PowerShell commands or base64 strings in their actions. This rule specifically looks for the use of `-EncodedCommand`, `-enc`, `-e`, `powershell`, `FromBase64String`, `IEX`, `Invoke-Expression`, and paths like `AppData`, `Temp`, or `ProgramData` within the command line, which are indicators of the PRISMEX implant used by APT28 for persistence.
Udm Mail Task Masquerade
YARA-L
Targets a scheduled task with trusted vendor wording whose action points to Temp, AppData, Public, or ProgramData. The UDM rule retains principal and target context for correlation.
Detects the creation of specific scheduled tasks known to be used by ScarCruft (APT37) to establish persistence for NarwhalRAT. The rule looks for scheduled task creation events (EventID 4698 in SecurityEvent logs or ActionType 'ScheduledTaskCreated' in DeviceEvents) where the task name matches known malicious task names used by ScarCruft, specifically 'MicrosoftUserInterfacePicturesUpdateTackMachine' and 'MicrosoftMusicLibrariesPackageTaskMachine'.
Detects if the backdoor file 'install-persistent.php' is scheduled for persistence via cron or Windows scheduled tasks. This indicates a potential supply chain compromise targeting ShapedPlugin.
Detects if schtasks is modifying an existing XenoUpdateManager task, indicating payload updating, as observed in Operation XENOFISCAL.
This rule detects the creation or modification of a Windows scheduled task that includes 'deno' in its command line. This activity is suspicious as it can indicate malware establishing persistence on a system, especially on typical office PCs where Deno is not commonly used. Further investigation is recommended to determine if the activity is legitimate or malicious.
Detects the creation of a scheduled task used by NarwhalRAT for persistence, using a specific task name and execution pattern. The rule looks for 'schtasks.exe' being executed with '/create' or '-create' flags and the unique task name 'MicrosoftUserInterfacePicturesUpdateTackMachine'. It covers process creation events from DeviceProcessEvents, SecurityEvent (EventID 4688), and Sysmon (EventID 1).
Detects the creation of a scheduled task named 'SoftwareProtection' that executes a Python payload, indicative of ModeloRAT persistence.
Detects the creation of a scheduled task named 'AlphaSecurity' using schtasks.exe with the '/create' command-line argument. This specific task name and creation method have been associated with the Broomstick backdoor, which is used by the Rhysida ransomware group for persistence.
This rule detects the creation of scheduled tasks (Event ID 4698) that are configured to execute scripting languages (PowerShell, cmd, Python, Java) with hidden window styles. This behavior is often indicative of an adversary attempting to establish persistence while evading detection by hiding the execution of their malicious scripts.
Detects the creation of a scheduled task named 'XenoUpdateManager' using 'schtasks.exe', which is associated with the Operation XENOFISCAL campaign and the SideCopy threat group. The rule also surfaces the parent process that initiated the scheduled task creation.
Detects the creation of the WindowsVaultSyncService scheduled task or a task using the specific misleading description observed in SHEETCREEP (APT36) infections. The malware uses the Task Scheduler COM API to establish persistence.
This rule detects the creation of scheduled tasks (Event ID 4698) that are configured to execute scripting languages (PowerShell, cmd, Python, Java) with hidden window styles. This behavior is often indicative of an adversary attempting to establish persistence while evading detection by hiding the execution of their malicious scripts.
This rule detects the creation of scheduled tasks (Event ID 4697) where the command line contains either 'System' or 'Admin'. This could indicate an attempt to create a scheduled task that runs with elevated privileges or impersonates system/admin accounts for persistence or privilege escalation.
Page 38 of 58