Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,212 detections
Filters
Last updated
All Time
Detection languages
509
326
77
74
65
Contributors
296
180
163
99
82
Categories
875
790
434
154
126
Platforms
1,196
17
13
6
5
Products / Services
443
331
276
228
118
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,212
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Detects indicators of compromise (IOCs) associated with the Ducktail Infostealer malware. This malware often targets Facebook Business accounts and exfiltrates data such as browser cookies, cryptocurrency wallet information, and account details.
This query detects potential Fox Kitten threat actor activity by analyzing ScheduledTaskCreated events.
It filters for suspicious task names (e.g., "update", "sync", "\Microsoft\Windows\EnterpriseMgmt"), non-system accounts, and risky commands (e.g., powershell, certutil). It also extracts task details, assigns risk levels (HIGH, MEDIUM, LOW) based on command patterns, and orders results by risk and timestamp for prioritized investigation.
It filters for suspicious task names (e.g., "update", "sync", "\Microsoft\Windows\EnterpriseMgmt"), non-system accounts, and risky commands (e.g., powershell, certutil). It also extracts task details, assigns risk levels (HIGH, MEDIUM, LOW) based on command patterns, and orders results by risk and timestamp for prioritized investigation.
KQL Query from file: High-Risk assets with command line credentials
KQL Query
KQL Query from file: Hunting NonEuclid RAT
KQL Query
Detects the loading of the "taskschd.dll" module from a process that located in a potentially suspicious or uncommon directory.
The loading of this DLL might indicate that the application have the capability to create a scheduled task via the "Schedule.Service" COM object.
Investigation of the loading application and its behavior is required to determining if its malicious.
The loading of this DLL might indicate that the application have the capability to create a scheduled task via the "Schedule.Service" COM object.
Investigation of the loading application and its behavior is required to determining if its malicious.
The analytic detects the use of the Win32_ScheduledJob WMI class via PowerShell script block logging. This class, which manages scheduled tasks, is disabled by default due to security concerns and must be explicitly enabled through registry modifications. The detection leverages PowerShell event code 4104 and script block text analysis. Monitoring this activity is crucial as it may indicate malicious intent, especially if the class was enabled by an attacker. If confirmed malicious, this could allow attackers to persist in the environment by creating scheduled tasks.
Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale
Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspicious location
Attackers can create a simple looking task in order to avoid detection on creation as it's often the most focused on
Instead they modify the task after creation to include their malicious payload
Attackers can create a simple looking task in order to avoid detection on creation as it's often the most focused on
Instead they modify the task after creation to include their malicious payload
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code
Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.
Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence
Detects the creation of the scheduled task named 'checker' which is used for persistence in the Discord Invite Loop Hole campaign, executing a VBScript every 5 minutes.
Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report
Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious
schtasks.exe create task from user AppData\Local\Temp
Detects update to a scheduled task event that contain suspicious keywords.
Detects remote execution via scheduled task creation or update on the destination host
Defrag Deactivation
Sigma
Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group
Detects potential exploitation of the BearLPE exploit using Task Scheduler ".job" import arbitrary DACL write\par
Page 51 of 58