Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,212 detections
Filters
Last updated
All Time
Detection languages
509
326
77
74
65
Contributors
296
180
163
99
82
Categories
875
790
434
154
126
Platforms
1,196
17
13
6
5
Products / Services
443
331
276
228
118
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,212
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Detects a combination of suspicious activities often associated with the LummaC2 stealer. This includes querying the 'Run' registry key for reconnaissance and creating a scheduled task for persistence, often named "Update" and set to run on logon.
Detects scenarios where an attacker abuse the at command to elevate privilages. Note that at command is deprecated since Windows 8 and replaced by schtask.
Detects scenarios where an attacker remotely creates a scheduled task over named pipes to execute commands or elevate privileges.
Detects scenarios where an attacker abuse task scheduler capacities to execute commands or elevate privileges.
Detects scenarios where APT actors exploits Fortinet vulnerabilities to gain access into Windows infrastructure.
The following analytic detects the creation of a Scheduled Task with a high entropy, randomly generated name, leveraging Event ID 4698. It uses the `ut_shannon` function from the URL ToolBox Splunk application to measure the entropy of the Task Name. This activity is significant as adversaries often use randomly named Scheduled Tasks for lateral movement and remote code execution, employing tools like Impacket or CrackMapExec. If confirmed malicious, this could allow attackers to execute arbitrary code remotely, potentially leading to further compromise and persistence within the network.
The analytic detects the creation of scheduled tasks designed to execute commands using native Windows shells like PowerShell, Cmd, Wscript, or Cscript. It leverages Windows Security EventCode 4698 to identify when such tasks are registered. This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment.
This rule detects process events where `svchost.exe` or `schtasks.exe` are the initiating processes on specific devices. This is designed to identify unexpected or suspicious scheduled tasks, whether system-initiated or user-triggered, on monitored devices. It can be used for hunting or to investigate alerts from other security tools regarding suspicious scheduled tasks.
Detects a variety of post-exploitation techniques observed in attacks leveraging SonicWall vulnerabilities (CVE-2024-40766). These techniques are associated with the Akira ransomware group and include defense evasion, credential access, and data staging.
This detects looks for the creation of scheduled tasks where the task content explicitly references a temporary file within the user's AppData\Local\Temp directory. This activity has been observed by AgentTesla as persistence mechanisms attempting to execute from a temporary location.
The following analytic detects potential malicious activities involving PowerShell's task scheduling cmdlets. It leverages PowerShell Script Block Logging (EventCode 4104) to identify unusual or suspicious use of cmdlets like 'New-ScheduledTask' and 'Set-ScheduledTask'. This activity is significant as attackers often use these cmdlets for persistence and remote execution of malicious code. If confirmed malicious, this could allow attackers to maintain access, deliver additional payloads, or execute ransomware, leading to data theft or other severe impacts. Immediate investigation and mitigation are crucial to prevent further compromise.
Identifies unsigned processes creating scheduled tasks, a common persistence mechanism for malware. **Validation**: Very High - Legitimate task creation is typically done by signed system utilities.
Generic rule content from file: Hunting Scheduled Tasks
winevent 4698
winevent 4698
Detects techniques used by the Dropping Elephant APT group to stage and execute a DLL side-loading attack using VLC Media Player. This includes the execution of VLC from suspicious paths, the use of PowerShell to download and rename payloads into those paths, and the specific scheduled task used for persistence.
Detects activity related to exploitation of Ivanti Connect Secure vulnerabilities (CVE-2025-0282, CVE-2025-22457) using MDifyLoader, Cobalt Strike, vshell, DslogdRAT, and Fscan. Includes file, process, and network-based IOCs from JPCERT report.
Detects Matanbuchus Malware Loader (IOCs) including file hashes, a scheduled task name, domains, and an IP address.
The analytic detects the creation of a new scheduled task with the highest execution privileges via Schtasks.exe. It leverages Endpoint Detection and Response (EDR) logs to monitor for specific command-line parameters ('/rl' and 'highest') in schtasks.exe executions. This activity is significant as it is commonly used in AsyncRAT attacks for persistence and privilege escalation. If confirmed malicious, this could allow an attacker to maintain persistent access and execute tasks with elevated privileges, potentially leading to unauthorized system access and data breaches.
Detects the creation of scheduled tasks (event ID 4698) where the task content includes references to potentially suspicious file paths and execution of known Living-off-the-Land Binaries and Scripts (LOLBAS). These behaviors are commonly associated with persistence mechanisms used by threat actors or malware.
Detects Matanbuchus malware loader IOCs including file hashes, a scheduled task name, domains, and an IP address.
The analytic detects the use of 'schtasks.exe' to create a scheduled task on a remote system, indicating potential lateral movement or remote code execution. It leverages process data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line arguments and flags. This activity is significant as it may signify an adversary's attempt to persist or execute code remotely. If confirmed malicious, this could allow attackers to maintain access, execute arbitrary commands, or further infiltrate the network, posing a severe security risk.
Detects the creation of a scheduled task with specific names and comments used by the BugSleep backdoor for persistence, as seen in recent MuddyWater campaigns.
Page 50 of 58