Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,212 detections
Filters
Last updated
All Time
Detection languages
509
326
77
74
65
Contributors
296
180
163
99
82
Categories
875
790
434
154
126
Platforms
1,196
17
13
6
5
Products / Services
443
331
276
228
118
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,212
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
This rule detects various activities associated with CloudZ and Pheno malware, including persistence mechanisms via scheduled tasks, execution of .NET loaders (regasm.exe), payload downloads using common utilities (curl, powershell, bitsadmin) from known staging patterns, reconnaissance artifacts, and network connections to known CloudZ infrastructure.
Detects the creation or modification of a specific scheduled task containing the string "M1onltor". This is an artifact of SHADOW-EARTH-053 establishing continuous persistence for their side-loaded malware loaders.
Detects the creation of the specific scheduled task 'SystemWindowsApis' or scheduled tasks querying for the malicious payload paths (e.g., 'windosDoc'), utilized for persistence by the CloudZ loader.
Detects the creation or modification of a ScheduledTasks.xml file within the SYSVOL directory, indicative of automated task deployment via Group Policy Preferences (GPP) commonly abused by adversaries. This activity can be used for persistence, privilege escalation, or lateral movement.
Detects the creation of a scheduled task executing binaries or scripts from the \Users\Public\ directory. This behavior has been observed in Tropic Trooper campaigns to maintain persistence and execute malicious payloads via the AdaptixC2 agent, but applies broadly to threat actors staging in the Public folder.
Detects the execution of a specific command line utilizing tasklist and taskkill to identify and terminate msedge.exe processes that do not have CoreUIComponents.dll loaded. This defense evasion technique is heavily utilized by UNC6692 via scheduled tasks to clean up headless Microsoft Edge processes executing their SNOWBELT malware.
This query searches for multiple indicators associated with the STAC4713 and STAC3725 campaigns (often linked to PayoutsKing/GOLD ENCOUNTER). It utilizes a fast free-text pre-filter followed by a case statement to categorize specific TTPs, including QEMU abuse, rogue scheduled tasks, suspicious services/accounts, covert tunneling, and credential access.
Detects the creation or modification of a ScheduledTasks.xml file within the SYSVOL directory. This behavior indicates automated task deployment via Group Policy Preferences (GPP), a technique observed in The Gentlemen RaaS and other operations to simultaneously execute ransomware or other payloads across domain-joined computers.
Detects the creation of scheduled tasks associated with the Dragon Boss Solutions AV killer malware. These tasks (e.g., 'DisableClockServicesFirst', 'RemoveClockPeriodic') are critical for the malware's continuous AV suppression and deep cleanup operations across reboots and logons.
Detects the creation of a scheduled task using schtasks.exe, potentially in combination with curl for downloading payloads and PowerShell for executing them.
This facilitates executing malicious payloads or connecting with C&C server persistently without dropping the malware sample on the host.
This facilitates executing malicious payloads or connecting with C&C server persistently without dropping the malware sample on the host.
Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence
Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence.
Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities
Detects multiple activities associated with the CTRL framework, including hiding user accounts, persistence via scheduled tasks, UAC bypass using wlrmdr.exe, RDP shadow session hijacking, VPN disconnects via rasdial, and RDP restriction loosening.
Detects DeepLoad-related behavioral chains including ClickFix PowerShell execution, mshta retrieval, scheduled task persistence, Add-Type or APC style injection, LockAppHost or related target process launches, WMI based re-execution, filemanager.exe execution, USB spread indicators, and known DeepLoad infrastructure communication.
Detects the CTRL persistence pattern by correlating suspicious registry value modifications (using disguised names like 'ShellStateVersion1', 'IconSizeVersion1', 'IconUnderlineVersion1') with the creation of scheduled tasks via PowerShell or schtasks.exe. The scheduled tasks often involve hidden or encoded commands and are set to launch at startup or with specific system privileges.
This rule detects various stages of DeepLoad malware activity, including initial delivery via PowerShell execution policy bypass with IEX/IRM style ClickFix, network retrieval using mshta.exe, persistence mechanisms like scheduled task creation and WMI, fileless injection through PowerShell Add-Type compilation and suspicious child processes (LockAppHost.exe, makecab.exe, Magnify.exe), credential stealing via filemanager.exe, and USB propagation indicators including specific C2 paths and LNK themed installer names. It also identifies known DeepLoad infrastructure domains.
This rule detects activity associated with BRUSHWORM/BRUSHLOGGER malware. It looks for network connections to the domain 'dawnnewsisl.com' with a URL path containing '/updtdll'. Additionally, it checks for process execution from a specific path pattern (e.g., '\ProgramData\Photoes\Pics\*.exe') or 'rundll32.exe' executing 'C:\Users\Public\Libraries\Recorder.dll'. The combination of these indicators aims to identify high-confidence BRUSHWORM/BRUSHLOGGER activity.
This rule detects various activities associated with the Kimsuky JavaScript dropper, including DNS requests to known malicious domains, creation of specific files (Themes.js, L298306.tmp), execution of certutil.exe or script.exe for decoding/encoding, suspicious command-line arguments for system information or task listing, and persistence mechanisms via scheduled tasks or registry modifications related to 'Themes.js' or 'Windows Theme Manager'.
Detects the creation of the 'WSPrint' scheduled task followed by specific registry modifications intended to hide the task from the Task Scheduler UI. This is a known persistence technique used by the UAT-9244 actor for its TernDoor backdoor.
Detects the creation of a scheduled task named "Recovery Diagnostics" that executes PowerShell scripts from the C:\Users\Public directory. This specific technique has been observed being used by threat actors as a persistence and execution mechanism during INC ransomware staging to trigger base64-encoded PowerShell payloads for data exfiltration.
Page 41 of 58