Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,212 detections
Filters
Last updated
All Time
Detection languages
509
326
77
74
65
Contributors
296
180
163
99
82
Categories
875
790
434
154
126
Platforms
1,196
17
13
6
5
Products / Services
443
331
276
228
118
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,212
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Detects scheduled task creations or modification on a suspicious schedule type
Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is an unusual program to be run from a Scheduled Task
Detects activity mentioned in Operation Wocao report
Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type
Detects the creation of scheduled tasks that involves a temporary folder and runs only once
Directly prior to deploying Macaw ransomware in an organization, the attacker will run several commands designed to disable security tools and system recovery tools.
The analytic detects the execution of tasks registered in Windows Task Scheduler by monitoring EventID 200 (action run) and 201 (action completed) from the Task Scheduler logs. This detection leverages Task Scheduler logs to identify potentially suspicious or unauthorized task executions. Monitoring these events is significant for a SOC as it helps uncover evasive techniques used for persistence, unauthorized code execution, or other malicious activities. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or the execution of harmful payloads, posing a significant threat to the environment.
Detects activity mentioned in Operation Wocao report
Detects post exploitation execution technique of the Serpent backdoor.
According to Proofpoint, one of the commands that the backdoor ran was via creating a temporary scheduled task using an unusual method.
It creates a fictitious windows event and a trigger in which once the event is created, it executes the payload.
According to Proofpoint, one of the commands that the backdoor ran was via creating a temporary scheduled task using an unusual method.
It creates a fictitious windows event and a trigger in which once the event is created, it executes the payload.
Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.
Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type
Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware
Detects the creation of a scheduled task via Registry keys.
Detects rare scheduled tasks creations that only appear a few times per time frame and could reveal password dumpers, backdoor installs or other types of malicious code
schtasks.exe create task from user AppData\Local\Temp
Detects post exploitation execution technique of the Serpent backdoor.
According to Proofpoint, one of the commands that the backdoor ran was via creating a temporary scheduled task using an unusual method.
It creates a fictitious windows event and a trigger in which once the event is created, it executes the payload.
According to Proofpoint, one of the commands that the backdoor ran was via creating a temporary scheduled task using an unusual method.
It creates a fictitious windows event and a trigger in which once the event is created, it executes the payload.
Detects execution of ChromeLoader malware via a registered scheduled task
Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.
Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands
StrRAT is a Java-based remote access tool which steals browser credentials, logs keystrokes and take remote control of infected systems. It also has a module to download additional payload onto to the infected machine based on C2 server command. Additionally, this threat also has a ransomware encryption/decryption module which appends .crimson extension.
Find attempts to stop System Restore and.
Prevent the system from creating restore points.
Prevent the system from creating restore points.
Page 53 of 58