Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,212 detections
Filters
Last updated
All Time
Detection languages
509
326
77
74
65
Contributors
296
180
163
99
82
Categories
875
790
434
154
126
Platforms
1,196
17
13
6
5
Products / Services
443
331
276
228
118
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,212
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Detects various activities associated with the UTA0388 threat actor and their GOVERSHELL malware family. This includes network connections to known C2 infrastructure, creation of persistence via scheduled tasks, and execution of the malware payload, often involving DLL side-loading. The detection logic covers network communication with known C2 domains and IPs, creation of scheduled tasks with specific names, execution of the malware from common staging directories with specific flags, and the dropping of GOVERSHELL DLLs or files with known hashes.
This rule detects the execution of scheduled tasks that launch specific, potentially suspicious, Living Off The Land Binaries (LOLBINs) or other uncommon programs. The detection focuses on programs like calc.exe, cscript.exe, mshta.exe, mspaint.exe, notepad.exe, regsvr32.exe, and wscript.exe when they are initiated by the Task Scheduler. The intent is to identify potentially malicious activity where adversaries might use scheduled tasks for persistence, execution, or privilege escalation by leveraging legitimate system utilities in an unusual context.
Detects the loading of the "taskschd.dll" module from a process that is located in a potentially suspicious or uncommon directory. The loading of this DLL might indicate that the application has the capability to create a scheduled task via the "Schedule.Service" COM object. Investigation of the loading application and its behavior is required to determine if it is malicious.
Detects various activities associated with the 'Operation Wocao' campaign, including the use of 'checkadmin.exe', 'netsh' commands to modify firewall rules, PowerShell execution with bypass and encoded commands, scheduled task creation, and attempts to query KeePass configuration files and PuTTY sessions from the registry. These activities indicate potential privilege escalation, persistence, discovery, and defense evasion techniques used by the threat actor.
This rule detects persistence mechanisms used by the Kapeka backdoor. It specifically looks for the creation of a scheduled task named "Sens Api" (or "OneDrive" in some cases) via `schtasks.exe` set to run on system startup, or the addition of an autorun registry entry named "Sens Api" under `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` via `reg.exe`. Both persistence methods are identified by their command lines calling `rundll32` with a `.wll` file and the export ordinal `#1`.
This rule detects the creation or registration of scheduled tasks using PowerShell cmdlets or WMI methods. It specifically looks for the use of `New-ScheduledTaskAction`, `New-ScheduledTaskTrigger`, `New-ScheduledTaskPrincipal`, `New-ScheduledTaskSettingsSet`, `New-ScheduledTask`, `Register-ScheduledTask` cmdlets, or the `Invoke-CimMethod` cmdlet targeting the `PS_ScheduledTask` class within the `Root\Microsoft\Windows\TaskScheduler` namespace. This activity is often abused by adversaries for persistence, privilege escalation, and execution.
Detects the creation of scheduled tasks with specific names ('SC Scheduled Scan' or 'UpdatMachine') that have been associated with the OilRig APT group for persistence, as reported by Nyotron in March 2018.
Detects the creation or modification of scheduled tasks via Group Policy Objects (GPO), which can be used by adversaries for persistence, execution, and lateral movement, often seen in ransomware deployment scenarios. The rule specifically looks for Event ID 5136 (Directory Service Changes) indicating modifications to GPO attributes related to machine or user extension names, and Event ID 5145 (Detailed File Share) indicating write access to ScheduledTasks.xml within the SYSVOL share.
Detects scheduled task deletion events. Scheduled tasks are likely to be deleted if not used for persistence. Malicious Software often creates tasks directly under the root node e.g. \TASKNAME
Detects remote RPC calls to the ITaskSchedulerService interface, specifically focusing on operations that create or execute scheduled tasks. This behavior is commonly associated with lateral movement and persistence techniques. The rule leverages an RPC Firewall to monitor these specific RPC calls.
This rule detects activity associated with the OilRig APT group, as detailed in Nyotron's March 2018 report. Specifically, it looks for the creation of a scheduled task named 'SC Scheduled Scan' that executes 'autoit3.exe' from a specific path, execution of executables within a '
Windows\Temp\DB\' directory, execution of 'C:\Windows\system32\Service.exe' with specific command-line arguments, and 'autoit3.exe' spawning 'nslookup.exe' with DNS TXT query parameters. These indicators collectively point to persistence mechanisms, execution of malicious payloads, and DNS-based command and control used by OilRig.
Windows\Temp\DB\' directory, execution of 'C:\Windows\system32\Service.exe' with specific command-line arguments, and 'autoit3.exe' spawning 'nslookup.exe' with DNS TXT query parameters. These indicators collectively point to persistence mechanisms, execution of malicious payloads, and DNS-based command and control used by OilRig.
Detects post-exploitation execution technique of the Serpent backdoor. This involves creating a temporary scheduled task using an unusual method: creating a fictitious Windows event and a trigger that executes a payload once the event is created. The detection specifically looks for command-line arguments indicative of this behavior when executed by cmd.exe or powershell.exe.
Detects when an attacker attempts to modify an existing scheduled task to execute a payload from suspicious locations. This technique allows attackers to bypass detection mechanisms that primarily focus on the creation of new scheduled tasks, by instead altering a legitimate task to include their malicious code.
This rule detects remote procedure call (RPC) activity related to the creation or execution of scheduled tasks using the SASec interface. Specifically, it looks for Event ID 3 from the RPC Firewall log source, where the InterfaceUuid matches '378e52b0-c0a9-11cf-822d-00aa0051e40f' (which corresponds to the Task Scheduler service) and the OpNum is either 0 (SchRpcRegisterTask) or 1 (SchRpcRunTask). This indicates an attempt to remotely register or run a scheduled task, which can be a method for lateral movement, execution, or persistence by adversaries.
Detects potential exploitation of the BearLPE exploit using Task Scheduler ".job" import arbitrary DACL write. This rule specifically looks for the execution of 'schtasks.exe' with command-line arguments indicative of modifying an existing scheduled task's properties, such as changing the user account and password, which could be abused in privilege escalation scenarios.
Detects the creation of a scheduled task using 'schtasks create' in conjunction with 'wscript' and '/e:vbscript', which is a known persistence mechanism used by the ACTINIUM threat group.
Detects scheduled task creation using the 'schtasks' utility that incorporates suspicious or uncommon command-line patterns. This includes tasks scheduled to run frequently (e.g., every minute) or as the 'system' user, combined with common command interpreters ('cmd'), or containing keywords often associated with malicious activity like PowerShell download commands, obfuscation techniques, or execution from temporary/public user directories. It also flags the use of scripting engines (cscript, wscript) or curl within scheduled tasks.
Detects the creation of new scheduled tasks via commandline using `schtasks.exe` that specifically call `OpenSSH` components (`sshd.exe` or `ssh.exe`) with parameters indicative of establishing a reverse SSH tunnel. This activity suggests an adversary is attempting to establish persistence and command-and-control by creating a scheduled task to maintain a connection to their server.
Detects the creation of a suspicious scheduled task named "CaptureService" that is set to run every 11 minutes. This specific combination of task name, frequency, and executable (rundll32.exe) is indicative of a known persistence technique.
Detects the deactivation and disabling of the Scheduled defragmentation task using 'schtasks.exe /delete' or 'schtasks.exe /change' commands, specifically targeting the '\Microsoft\Windows\Defrag\ScheduledDefrag' task. This activity has been observed in campaigns by the Slingshot APT group.
Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or it's an unusual program to be run from a Scheduled Task. This rule specifically looks for Event ID 129 (Created Task Process) in the Task Scheduler Operational logs and checks if the executable path contains common temporary or user-download directories.
Page 46 of 58