Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,212 detections
Filters
Last updated
All Time
Detection languages
509
326
77
74
65
Contributors
296
180
163
99
82
Categories
875
790
434
154
126
Platforms
1,196
17
13
6
5
Products / Services
443
331
276
228
118
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,212
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Detects the execution of the hacktool SharPersist, which is used to deploy various persistence mechanisms on Windows systems. The rule specifically identifies SharPersist.exe being executed with command-line arguments indicative of creating scheduled tasks, modifying startup folders, adding registry run keys, or installing new services for persistence.
Monitors for the creation or modification of scheduled tasks in the Windows registry by processes other than common legitimate ones like svchost.exe. This can indicate an adversary establishing persistence or executing malicious code via scheduled tasks.
This rule detects the creation of scheduled tasks using `schtasks.exe` where the parent process originates from a suspicious temporary or user-specific directory. Adversaries often use scheduled tasks for persistence and privilege escalation, and executing the task creation utility from locations like `Temp`, `AppData\Local`, `AppData\Roaming`, `Temporary Internet Files`, or `Users\Public` can indicate malicious activity. Multiple malware strains have been observed employing this technique.
Detects suspicious PowerShell execution initiated by a scheduled task (svchost.exe -k netsvcs -s Schedule) where the PowerShell command line includes flags commonly used to hide the PowerShell instance or bypass execution policies, such as '-windowstyle hidden', '-w hidden', '-ep bypass', or '-noni'. This pattern is indicative of persistence mechanisms, specifically referencing the PowerShell 'Get-Variable' technique used by Colibri Loader.
Detects execution of ChromeLoader malware via a registered scheduled task, specifically looking for PowerShell executing Chrome with a `--load-extension` argument pointing to a suspicious local path.
Detects the creation of a scheduled task using `schtasks.exe` that includes `curl` for downloading content and `powershell` for execution within the task's action. This combination is often used by adversaries to establish persistence, download malicious payloads, and execute them without directly dropping malware on the host, facilitating command and control.
Detects the creation of scheduled tasks using 'schtasks.exe' where the task's executable path points to suspicious folders or uses environment variables commonly abused by malware for persistence or privilege escalation. This rule specifically looks for tasks created in locations like 'Perflogs', 'Users\All Users', 'Users\Default', 'Users\Public', 'Windows\Temp', 'AppData\Local', 'AppData\Roaming', or using '%AppData%' and '%Public%' environment variables.
Detects the creation of a suspicious scheduled task named "CaptureService" that is set to run every 11 minutes. This specific combination of task name, frequency, and executable (rundll32.exe) is indicative of a known persistence technique.
Detects the creation of scheduled tasks in the `C:\Windows\System32\Tasks` directory by processes originating from suspicious locations such as user `AppData` folders, `C:\PerfLogs`, or `C:\Windows\System32\config\systemprofile`. This activity can indicate persistence or privilege escalation attempts by malware or adversaries.
Detects manual execution of the "Microsoft Compatibility Appraiser" task via schtasks. This activity is often used to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.
Detects the creation or modification of a scheduled task using 'schtasks.exe' that is configured to run with 'NT AUTHORITY\SYSTEM' privileges. This can be an indicator of privilege escalation or persistence.
Detects the creation of a scheduled task where the task name (`/TN`) is a GUID-like string. This behavior is often observed in malware or advanced persistent threats to maintain persistence or execute malicious code, as using GUIDs can help obfuscate the task's purpose or make it less conspicuous among legitimate tasks.
Detects the creation of a scheduled task using the "-XML" flag with a file that does not have the '.xml' extension. This behavior is suspicious because it attempts to masquerade the XML configuration file, potentially as a defense evasion technique during persistence establishment. Adversaries might use this to hide their scheduled tasks from casual inspection.
Detects potential persistence behavior by monitoring modifications to the Windows TelemetryController registry key. Adversaries can abuse the `CompatTelRunner.exe` binary, which is used by Windows telemetry, to execute arbitrary commands specified in the registry. This rule specifically looks for modifications to the `TelemetryController` subkey where the `Command` value is set to execute common executable file types.
Detects the creation of a scheduled task using 'schtasks.exe' that is configured to execute a file from the 'C:\Users\<USER>\AppData\Local' directory. This behavior is often indicative of malware establishing persistence or privilege escalation, as the AppData\Local folder is a common location for user-specific application data and can be written to without administrative privileges. The rule specifically looks for tasks created to run under 'NT AUTHORITY\SYSTEM' or 'SYSTEM' accounts, which would grant elevated privileges to the executed payload.
This rule detects the creation of scheduled tasks using 'schtasks.exe' where the command line includes common scripting interpreters (powershell, pwsh, cmd) and specifies a suspicious folder path like 'C:\ProgramData\' or '%ProgramData%'. This combination is often used by adversaries for persistence or privilege escalation by scheduling malicious code to run from a location typically used for application data, which can be less monitored than system directories.
Detects the creation or modification of scheduled tasks using `schtasks.exe` with suspicious schedule types such as 'ONLOGON', 'ONSTART', 'ONCE', or 'ONIDLE'. This rule specifically filters out common legitimate system accounts like 'NT AUTHORITY\SYSTEM' and 'SYSTEM' and the 'HIGHEST' privilege setting to reduce false positives.
Detects the creation of a scheduled task using 'schtasks.exe' that is configured to execute a PowerShell command. The PowerShell command specifically attempts to retrieve a base64 encoded payload from the Windows Registry (HKCU or HKLM hive) and execute it. This technique is often used by adversaries for persistence and to evade detection by obfuscating the malicious payload.
Detects the creation or modification of scheduled tasks using 'schtasks.exe' that are configured to run with high privileges (NT AUTHORITY\SYSTEM, SYSTEM, or HIGHEST) and utilize suspicious schedule types such as ONLOGON, ONSTART, ONCE, or ONIDLE. This combination is often indicative of persistence or privilege escalation attempts by adversaries.
Detects the creation of scheduled tasks using 'schtasks.exe' that are configured to run only once and involve a temporary folder in their command line. This behavior can be indicative of an adversary establishing temporary persistence or execution mechanisms, often seen in post-exploitation activities.
Detects the creation of a scheduled task that uses PowerShell to retrieve and execute a payload stored in the Windows Registry. This technique is often used for persistence and privilege escalation by malware like Qbot.
Page 47 of 58