Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,212 detections
Filters
Last updated
All Time
Detection languages
509
326
77
74
65
Contributors
296
180
163
99
82
Categories
875
790
434
154
126
Platforms
1,196
17
13
6
5
Products / Services
443
331
276
228
118
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,212
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Prior to deploying Macaw ransomware in an organization, the adversary will disable several tools and functions in order to inhibit later recovery efforts.
Defrag Deactivation
Sigma
Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group
Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability
Detects Kapeka backdoor persistence activity.
Depending on the process privileges, the Kapeka dropper then sets persistence for the backdoor either as a scheduled task (if admin or SYSTEM) or autorun registry (if not).
For the scheduled task, it creates a scheduled task called "Sens Api" via schtasks command, which is set to run upon system startup as SYSTEM.
To establish persistence through the autorun utility, it adds an autorun entry called "Sens Api" under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run via the "reg add" command.
Both persistence mechanisms are set to launch the binary by calling rundll32 and passing the backdoor's first export ordinal (#1) without any additional argument.
Depending on the process privileges, the Kapeka dropper then sets persistence for the backdoor either as a scheduled task (if admin or SYSTEM) or autorun registry (if not).
For the scheduled task, it creates a scheduled task called "Sens Api" via schtasks command, which is set to run upon system startup as SYSTEM.
To establish persistence through the autorun utility, it adds an autorun entry called "Sens Api" under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run via the "reg add" command.
Both persistence mechanisms are set to launch the binary by calling rundll32 and passing the backdoor's first export ordinal (#1) without any additional argument.
Detects specific process parameters as used by ACTINIUM scheduled task persistence creation.
Detects commands used by Turla group as reported by ESET in May 2020
Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.
Detects manual execution of the "Microsoft Compatibility Appraiser" task via schtasks.
In order to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.
In order to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.
Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.
Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges
Detects scheduled task creation events that include suspicious actions, and is run once at 00:00
Detects creation of a scheduled task with a GUID like name
Detects the creation of a schtask that executes a file from C:\Users\<USER>\AppData\Local
Detects scheduled task creations that have suspicious action command and folder combinations
Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands
Detects the creation of scheduled tasks that involves a temporary folder and runs only once
Detects potential persistence behavior using the windows telemetry registry key.
Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections.
This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run.
The problem is, it will run any arbitrary command without restriction of location or type.
Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections.
This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run.
The problem is, it will run any arbitrary command without restriction of location or type.
Detects the execution of "schtasks.exe" from a parent that is located in a potentially suspicious location.
Multiple malware strains were seen exhibiting a similar behavior in order to achieve persistence.
Multiple malware strains were seen exhibiting a similar behavior in order to achieve persistence.
This rule detects rare scheduled task creations. Typically software gets installed on multiple systems and not only on a few. The aggregation and count function selects tasks with rare names.
Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities
Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unusale program to be run from a Scheduled Task
Page 54 of 58