Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,212 detections
Filters
Last updated
All Time
Detection languages
509
326
77
74
65
Contributors
296
180
163
99
82
Categories
875
790
434
154
126
Platforms
1,196
17
13
6
5
Products / Services
443
331
276
228
118
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,212
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
In this campaign, the threat actor leveraged specially crafted Microsoft RTF files to exploit CVE-2026-21509 and deliver malicious backdoors in a multi-stage infection chain. Due to significant overlaps in tools, techniques, and procedures (TTPs) between this campaign and those of the Russia-linked advanced persistent threat (APT) group APT28, we attribute this new campaign to APT28 with high confidence. Microsoft released an out-of-band update to address CVE-2026-21509 on January 26, 2026. ThreatLabz observed active in-the-wild exploitation on January 29, 2026.
Detects the creation of a scheduled task named 'SoftwareProtection' used by the CrashFix campaign to execute a renamed Python interpreter for persistence.
Detects the use of QEMU with port forwarding (`hostfwd`), a technique observed being used by attackers to create a persistent, virtualized environment for C2 and lateral movement, often via a scheduled task. The rule looks for the creation of scheduled tasks that launch QEMU with port forwarding or the direct execution of QEMU with port forwarding by common parent processes associated with scheduled tasks or remote administration.
Detects a specific persistence mechanism where a scheduled task named 'TPMProfiler' is used to run QEMU, establishing an SSH backdoor. This technique was identified by Huntress in post-exploitation activity related to SolarWinds WHD exploitation. The rule identifies both the execution of QEMU with SSH port forwarding command-line arguments and the creation of the malicious scheduled task.
Detects TTPs associated with the Lazarus Group malware families OtterCookie and BeaverTail. This rule identifies persistence via registry run keys and scheduled tasks, suspicious node.js execution for keylogging, and network connections to known C2 infrastructure.
This rule detects the creation of scheduled tasks on remote systems using the 'schtasks.exe' utility. Specifically, it looks for instances where a scheduled task is created with high-privilege accounts such as 'Administrator', 'SYSTEM', or 'NT AUTHORITY'. The detection logic requires the presence of '/create', '/s' (specifying a remote system), '/tr' (task run), '/tn' (task name), and '/ru' (run as user) flags in the command line. It explicitly filters out tasks created on the local machine (localhost, 127.0.0.1, ::1). This activity is indicative of potential lateral movement or privilege escalation, as adversaries often use remote scheduled tasks to establish persistence or execute commands on other systems within a network with elevated privileges.
This rule detects the creation of scheduled tasks using the `schtasks.exe` utility with specific parameters indicating elevated privileges. Specifically, it looks for tasks created with the `/create` command, running under the `SYSTEM` user account (`/ru SYSTEM`), and with the highest privilege level (`/rl HIGHEST`). This combination of parameters is often leveraged by adversaries for defense evasion, persistence, and privilege escalation by ensuring the scheduled task executes with maximum system privileges.
This rule detects the creation of a process that involves 'qemu' in its image path and contains 'hostfwd=tcp' along with either 'vault.db' or 'bisrv.dll' in its command line. This combination is indicative of an SSH backdoor deployment, specifically observed in the context of SolarWinds Web Help Desk exploitation where threat actors establish persistence using a scheduled task named TPMProfiler to execute QEMU with an SSH port forward.
This rule detects the creation of a scheduled task with 'TPMProfiler' in its command line. This specific task name has been observed in malicious contexts related to SolarWinds Web Help Desk exploitation, typically used for persistence to run QEMU for an SSH backdoor. While legitimate TPM-related tasks exist, the 'TPMProfiler' name in this context is indicative of compromise.
Detects persistence mechanisms used by the OtterCookie malware, part of the Lazarus "Contagious Interview" campaign. It specifically looks for the creation of a 'NodeHelper' registry run key and a 'NodeUpdate' scheduled task.
Detects the multi-stage DEAD#VAX infection chain by correlating the creation of a specific batch file artifact with subsequent execution, persistence, or process injection activities.
Detects creation of a scheduled task named Microsoft\Windows\Defrag\CorelDefrag configured to execute an obfuscated PowerShell payload on a daily basis. This task mimics a legitimate Windows Defrag task to maintain persistence.
Detects persistence mechanisms used by the Interlock RAT, which leverages specific, deceptive scheduled task names related to Defrag, Chkdsk, and TimeSync to maintain a foothold on compromised systems.
Detects the creation of scheduled tasks using 'schtasks /create' that include suspicious command-line arguments often associated with malicious activity, such as PowerShell execution, web requests (Invoke-WebRequest, curl, wget, bitsadmin), or script execution (.ps1, .vbs, .js). This rule aims to identify persistence mechanisms or initial access attempts.
Detects the creation of scheduled tasks used for persistence by fake PDF converter malware. These tasks are created in the registry under the TaskCache tree.
Pulsar RAT is a derivative of Quasar RAT with extensive functionality including keylogging, cryptocurrency wallet clipping, credential theft, file management, remote shell execution, and data exfiltration capabilities. As a modular, open-source remote administration tool designed for Windows systems, Pulsar introduces significant enhancements over its predecessor.
Detects the creation of scheduled tasks with specific names and command lines used by the TamperedChef malware for persistence.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility with the '/Create' argument. This can indicate an adversary establishing persistence or scheduling malicious activity.
Detects the initial VBScript loader used in Turla's Kazuar v3 campaign. The loader script (8RWRLT.vbs) is executed via wscript.exe and creates a folder structure mimicking HP printer drivers at %LOCALAPPDATA%\Programs\HP\Printer\Driver. The script downloads multiple files from a remote C2 server including hpbprndi.exe (a legitimate signed HP driver), hpbprndiLOC.dll (the actual Kazuar loader), and encrypted payload files (jayb.dadk, kgjlj.sil, pkrfsu.ldy). The loader uses WinHttp.WinHttpRequest.5.1 COM object to download files while ignoring SSL certificate errors, and establishes persistence by creating a registry entry in HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. This rule specifically looks for wscript.exe processes with command lines containing both the HP printer driver path and hpbprndi references, which are strong indicators of the Kazuar v3 loader execution.
Detects scheduled tasks configured to run as SYSTEM executing suspicious binaries or commands, often used for privilege escalation and defense evasion.
Detects the use of Visual Studio Code (VSCode) tunnels for command and control (C2) or persistence. This technique, observed in use by threat actors like MUSTANG PANDA, leverages legitimate VSCode functionality to bypass network defenses.
Page 44 of 58