Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
538 detections
Filters
Last updated
All Time
Detection languages
194
92
58
49
47
Contributors
201
94
75
43
39
Categories
408
371
230
67
67
Platforms
523
17
5
3
2
Products / Services
10,665
9,773
6,705
4,421
3,749
538
MITRE Techniques
476
459
443
233
98
CVEs
3
3
1
1
1
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
Detects the creation of scheduled tasks using schtasks.exe where the command originates from or references the C:\ProgramData\ directory. This pattern is consistent with the SystemBC (Coroxy) malware's persistence mechanism, where a randomly named executable is staged in ProgramData and configured for execution via Task Scheduler.
Detects the Payouts King malware creating, running, or deleting specific scheduled tasks named \Mozilla\UpdateTask or \Mozilla\ElevateTask, as well as indirect execution of these tasks via cmd.exe redirection.
Detects the creation of scheduled tasks (via schtasks.exe or at.exe) that include command-line arguments referencing virtualization artifacts (qemu, .qcow2, .vmdk, TPMProfiler) or specific database/dll files (vault.db, bisrv.dll). This pattern is often indicative of persistence mechanisms used by malware or threat actors to manage virtualized environments, exfiltrate data, or deploy components.
This rule detects the creation of scheduled tasks using 'schtasks.exe' or PowerShell's 'Register-ScheduledTask' cmdlet. The detection focuses on command lines that include indicators of suspicious activity, such as encoded commands, hidden window styles, or placement in temporary or application data directories, specifically when the initiating process is not a signed Microsoft binary.
Detects persistence mechanisms associated with the MYRA RAT. This includes Linux/macOS crontab modification using specific schedules or shell profile writes initiated by node/npm processes, as well as Windows scheduled task creation or task manipulation via schtasks.exe initiated by node/npm processes.
Detects the creation of a scheduled task via schtasks.exe that executes a command interpreter or script engine (e.g., PowerShell, cmd, wscript) where the parent process is not signed by Microsoft. This behavior is often associated with the execution of malicious payloads, persistence mechanisms, or lateral movement.
This rule detects the creation or registration of scheduled tasks that involve the 'PerfWatson2.exe' utility or execution paths originating from within the local AppData directory. These patterns are often associated with persistence mechanisms used by malware or malicious scripts to maintain execution after reboots.
This rule detects the creation of scheduled tasks using the 'schtasks.exe' utility with command-line arguments indicating persistence triggers ('onlogon', 'onstart') or elevation to the 'SYSTEM' account. Adversaries commonly use these methods to ensure malicious code executes automatically upon system startup or with high privileges to facilitate further exploitation.
This rule detects a multi-stage loader chain behavior. Stage 1 identifies PowerShell spawning mshta.exe or wscript.exe, which is commonly used to execute malicious scripts or loaders. Stage 2 detects mshta.exe or wscript.exe subsequently executing schtasks.exe or wmic.exe with command-line arguments indicative of establishing persistence via scheduled tasks or WMI event subscriptions.
Detects persistence attempts by the Amadey infostealer. The rule monitors for unauthorized creation of .job files directly in the Windows Tasks directory or the execution of schtasks.exe from suspicious locations such as TEMP or APPDATA folders.
This rule detects potential tampering with security software processes and services, as well as the execution of suspicious batch scripts (i.bat). It identifies when administrative tools like sc.exe, taskkill.exe, or net.exe are used to stop or delete security agents such as Sysmon, Filebeat, SentinelAgent, or antivirus services. It also monitors for the execution of 'i.bat' via command shell, which is commonly associated with malicious automation or persistence.
This rule detects persistence mechanisms associated with BeepRAT (a DcRAT variant) by correlating the creation of suspicious files (DLL, EXE, or C files) in user-writable directories (e.g., AppData, Temp, ProgramData) with the subsequent execution of 'schtasks.exe /create'. It specifically monitors for task creation commands referencing these suspicious paths, known loader binaries (rundll32, regsvr32, tcc.exe), or specific naming conventions like 'WindowsUpdateTempFileCleanUp'.
Detects use of scheduled tasks to break process trees and hide parent relationships
Detects the creation of scheduled tasks using schtasks.exe that exhibit indicators associated with StrikeShark SharkLoader or Cobalt Strike persistence. Indicators include task actions that reference rundll32 with a DLL, execution from user-writable directories (AppData, ProgramData, Temp), the use of base64-encoded command lines, or specific task names mimicking OneDrive updates.
Detects the creation of scheduled tasks using schtasks.exe initiated from potentially suspicious parent directories (C:\Users\Public\ or C:\Windows\Temp\) or parent processes containing 'win_guard_'. This behavior is often associated with malware attempting persistence.
Detects the creation of scheduled tasks using the schtasks utility that masquerade as legitimate update services (MicrosoftEdgeUpdate or GoogleUpdaterTaskSystem). These tasks are configured to run at logon with highest privileges, specifically aiming to persist the TinyRCT backdoor (associated with files such as vmwared.exe or vmtools.exe) in ProgramData directories.
Detects the creation of a 'MasterPackager.Updater' scheduled task by a suspicious instance of RegAsm.exe (hollowed process). The task is configured to execute a VBScript located in C:\Users\Public every two minutes, a known tactic associated with AsyncRAT delivery chains.
This rule detects a multi-stage loader chain behavior. Stage 1 identifies PowerShell spawning mshta.exe or wscript.exe, which is commonly used to execute malicious scripts or loaders. Stage 2 detects mshta.exe or wscript.exe subsequently executing schtasks.exe or wmic.exe with command-line arguments indicative of establishing persistence via scheduled tasks or WMI event subscriptions.
Detects the creation of specific scheduled tasks associated with LoaderClient or WeedHack malware. These tasks, named 'JMonitoringTask' or 'JavaSecurityUpdater', are used for persistence and recurring execution of malicious code.
Page 16 of 26