Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
538 detections
Filters
Last updated
All Time
Detection languages
194
92
58
49
47
Contributors
201
94
75
43
39
Categories
408
371
230
67
67
Platforms
523
17
5
3
2
Products / Services
10,665
9,773
6,705
4,421
3,749
538
MITRE Techniques
476
459
443
233
98
CVEs
3
3
1
1
1
Detects the creation of specific scheduled tasks associated with LoaderClient or WeedHack malware. These tasks, named 'JMonitoringTask' or 'JavaSecurityUpdater', are used for persistence and recurring execution of malicious code.
Detects attempts to disable or impair Microsoft Defender Antivirus using legitimate system administration tools such as PowerShell (Set-MpPreference, Add-MpPreference), WMIC, sc.exe, or net.exe. Adversaries may use these tools to bypass security controls by disabling real-time monitoring or adding unauthorized exclusion paths.
Detects the creation of scheduled tasks using schtasks.exe or at.exe by processes not signed by Microsoft. This behavior is often associated with adversary attempts to establish persistence by running code on a recurring basis or at specific times using native Windows utilities.
Detects the creation of scheduled tasks using schtasks.exe or at.exe by processes not signed by Microsoft. This behavior is often associated with adversary attempts to establish persistence by running code on a recurring basis or at specific times using native Windows utilities.
Detects the creation or modification of scheduled tasks using the schtasks.exe utility initiated by a process not signed by Microsoft. This behavior is often associated with adversary attempts to establish persistence or automate malicious code execution.
Detects the creation or modification of scheduled tasks using the schtasks.exe utility initiated by a process not signed by Microsoft. This behavior is often associated with adversary attempts to establish persistence or automate malicious code execution.
Detects the creation of a new scheduled task using the Windows native schtasks.exe command-line utility. This behavior is commonly associated with persistence mechanisms or lateral movement activities where attackers schedule tasks to execute malicious payloads.
Detects the creation of a new scheduled task using the Windows native schtasks.exe command-line utility. This behavior is commonly associated with persistence mechanisms or lateral movement activities where attackers schedule tasks to execute malicious payloads.
Detects the creation or modification of a scheduled task named 'OneDrive Update', which is known to be used by the BLUERABBIT backdoor for persistence. The rule looks for Windows Security Events (EventID 4698 for task creation, 4702 for task modification) and process execution events where command lines indicate scheduled task registration via tools like 'schtasks', 'Register-ScheduledTask', or 'New-ScheduledTask' with the specific task name 'OneDrive Update'.
Hunting rule for Atomic Red Team T1490 test "Windows - Disable the SR scheduled task". Correlate before alerting.
Hunting rule for Atomic Red Team T1490 test "Windows - Disable the SR scheduled task". Correlate before alerting.
Detects adversary activity associated with CL-STA-1062, specifically the use of archive extraction tools to unpack content into hidden or masqueraded ProgramData directories (VMware, Microsoft, Intel). The rule also monitors for process execution and the creation of scheduled tasks that utilize these specific staging paths.
Loader used in click-hijacking traffic distribution scheme
USB worm and loader leveraging living-off-the-land binaries
High-velocity ransomware-as-a-service with aggressive leak-site extortion
Latin American banking trojan using DLL side-loading and overlay attacks
AI-powered phishing-as-a-service abusing device-code authentication
Banking trojan and loader using malicious Office macro delivery
Credential and browser data stealer distributed via OXLOADER campaigns
Detects a privilege escalation technique that exploits the Windows Error Reporting (WER) 'QueueReporting' scheduled task. An attacker leverages the Task Scheduler COM API to trigger this task, causing 'wermgr.exe' to execute as SYSTEM from an attacker-controlled directory (often via directory junction redirection), subsequently spawning shell processes.
Detects malicious scheduled task activity attributed to the Payouts King threat actor. The rule monitors for the creation, execution, and deletion of tasks using specific naming conventions ('Mozilla\UpdateTask', 'Mozilla\ElevateTask') or patterns (e.g., /ru SYSTEM, /sc ONSTART) executed by non-standard parent processes.
Page 17 of 26