Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,212 detections
Filters
Last updated
All Time
Detection languages
509
326
77
74
65
Contributors
296
180
163
99
82
Categories
875
790
434
154
126
Platforms
1,196
17
13
6
5
Products / Services
443
331
276
228
118
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,212
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Detects the creation of scheduled tasks using `schtasks.exe` where the command line arguments include names of common Windows system processes. This behavior can indicate an adversary attempting to masquerade a malicious scheduled task as a legitimate system process for persistence or privilege escalation.
Detects suspicious scheduled task creation (schtasks.exe /create) linked to known Subtle Snail file hashes, malicious payload filenames, and recruitment paths. Correlates with parent processes commonly abused (browsers, explorer) and excludes benign system processes and service accounts. Aggregates events to highlight clustered activity for effective threat hunting.
This analytic detects instances of 'svchost.exe' spawning Living Off The Land Binaries and Scripts (LOLBAS) processes. It leverages Endpoint Detection and Response (EDR) data to monitor child processes of 'svchost.exe' that match known LOLBAS executables. This activity is significant as adversaries often use LOLBAS techniques to execute malicious code stealthily, potentially indicating lateral movement or code execution attempts. If confirmed malicious, this behavior could allow attackers to execute arbitrary commands, escalate privileges, or maintain persistence within the environment, posing a significant security risk.
This analytic detects the creation of scheduled tasks on Windows systems where the command arguments include HTTP strings. This behavior is often indicative of malware activity or the use of Living off the Land binaries (LOLBins) to download additional payloads. Such activity, if malicious, could lead to data exfiltration, malware propagation, or unauthorized access.
Detects the execution of executables with specific names ("WinHealth.exe", "WindowsSecurity.exe") known to be dropped by the SonicCrypt crypter. The execution is often initiated by the Task Scheduler, resulting in a parent process of 'taskhostw.exe'.
Detects a two-stage behavior characteristic of the SonicCrypt crypter: 1) A process creates a suspicious executable in a Windows system directory. 2) The newly created executable is then launched by the Windows Task Scheduler.
Detects the execution of the BitLocker Access Agent Update Utility (baaupdate.exe) spawning suspicious child processes. This activity is uncommon for baaupdate.exe and could indicate an attempt at lateral movement or defense evasion, potentially via BitLocker DCOM & COM Hijacking, by using baaupdate.exe as a proxy for executing other system utilities.
The analytic detects the creation, modification, or enabling of scheduled tasks that execute commands using native Windows shells (PowerShell, Cmd, Wscript, Cscript) or from public folders (Users, Temp, ProgramData). This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment.
The following analytic identifies the creation or deletion of scheduled tasks using the schtasks.exe utility with the -create or -delete flags. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it can indicate unauthorized system manipulation or malicious intent, often associated with threat actors like Dragonfly and incidents such as the SUNBURST attack. If confirmed malicious, this activity could allow attackers to execute code, escalate privileges, or persist within the environment, posing a significant security risk.
The analytic detects the creation of scheduled tasks in Windows using `schtasks.exe` with the `/xml` or `-xml` parameter. This activity is significant as it is a common technique for establishing persistence or achieving privilege escalation, often used by malware like Trickbot and Winter-Vivern. While creating a scheduled task via XML may be legitimate, it can also be abused by attackers. If confirmed malicious, this could allow attackers to maintain access, execute additional payloads, and potentially lead to data theft or ransomware deployment.
The analytic identifies the creation of scheduled tasks that execute binaries or scripts from public directories, such as Users\Public, ProgramData, or Windows\Temp, using schtasks.exe with the /create command. This activity often indicates an attempt to maintain persistence or execute malicious scripts, which are common tactics in malware deployment. If confirmed as malicious, this could lead to data compromise, unauthorized access, and potential lateral movement within the network.
The following analytic detects the creation, modification, or enabling of scheduled tasks with known suspicious or malicious task names. It leverages Windows Security EventCode 4698, 4700, and 4702 to identify when such tasks are registered, modified, or enabled. This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment.
The analytic detects the creation of scheduled tasks within user-writable paths using Windows Security EventCode 4698. It identifies tasks registered via schtasks.exe or TaskService that execute commands from directories like Public, ProgramData, Temp, and AppData. This behavior is significant as it may indicate an attempt to establish persistence or execute unauthorized commands. If confirmed malicious, an attacker could maintain long-term access, escalate privileges, or execute arbitrary code, posing a severe threat to system integrity and security.
Detects the creation of scheduled tasks that involves a temporary folder and runs only once
Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.
Detects the creation of a scheduled task that launches an executable from a non-standard, writable directory, which subsequently loads a co-located DLL. This pattern is a form of DLL Sideloading used for persistence and was observed in a ToddyCat APT attack.
Detects a process launched by the Windows Task Scheduler from a non-standard directory that immediately loads a DLL from the same directory. This is a strong indicator of DLL Sideloading for persistence, as seen in campaigns by groups like ToddyCat.
Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale
Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unusale program to be run from a Scheduled Task
Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is an unusual program to be run from a Scheduled Task
Detects the creation of a schtask that executes a file from C:\Users\<USER>\AppData\Local
Page 48 of 58