Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
538 detections
Filters
Last updated
All Time
Detection languages
194
92
58
49
47
Contributors
201
94
75
43
39
Categories
408
371
230
67
67
Platforms
523
17
5
3
2
Products / Services
10,665
9,773
6,705
4,421
3,749
538
MITRE Techniques
476
459
443
233
98
CVEs
3
3
1
1
1
Detects the creation of scheduled tasks at 1-minute intervals using 'schtasks.exe' that employ masqueraded names (e.g., MicrosoftUserInterface) or execute known suspicious payloads associated with the NarwhalRAT malware (e.g., python scripts or .cat files). This behavior is characteristic of persistence mechanisms used by APT37.
Detects the creation of suspicious scheduled tasks by monitoring Windows Event Logs (EventCode 4698) for task XML content and process creation events (EventCode 1) for the 'schtasks.exe' utility. The rule identifies tasks created in user-writable paths (like AppData or Temp), tasks containing suspicious keywords like 'hidden' or specific Mozilla update patterns, tasks configured to run as SYSTEM, and tasks spawned by non-standard parent processes.
Open-source derived remote access trojan with plugin architecture
Detects the creation of a scheduled task masquerading as a legitimate Mozilla maintenance task (UpdateTask or ElevateTask). The rule specifically flags when such tasks are configured to run as SYSTEM, triggered on system start, and are created via a command line executed by a parent process of cmd.exe, which is indicative of Payouts King ransomware persistence activity.
Detects BQTLock ransomware (BaqiyatLock) establishing persistence by creating scheduled tasks via schtasks.exe. The detection monitors for scheduled task creation commands initiated by the ransomware payload (BQT.exe) or its loader (start.exe), specifically targeting tasks that execute files from high-risk paths like AppData or Temp, or directly reference BQT.exe.
Detects the creation of scheduled tasks using schtasks.exe that reference specific QEMU binaries, the 'TPMProfiler' task name, or suspicious disk image file extensions (vault.db, bisrv.dll, custom.qcow2). This activity is associated with GOLD ENCOUNTER, STAC4713, and STAC3725, who use QEMU-based virtual environments for defense evasion and persistence.
Detects the creation of scheduled tasks designed for persistence, typically used by Operation Poisson (e.g., Demon agent, Python keyloggers). The rule identifies tasks that execute script interpreters (powershell.exe, cmd.exe, wscript.exe, cscript.exe, python.exe, pythonw.exe) with indicators of suspicious intent, such as hidden windows (/WindowStyle Hidden, /c) or elevated privileges (HighestAvailable, HighestPrivilege, AtLogon).
Detects the creation of a Windows scheduled task using 'schtasks.exe' with the 'Highest' run level, configured to execute either 'powershell.exe' or 'wscript.exe'. This pattern is consistent with persistence mechanisms observed in Operation Poisson, where attackers establish elevated, automated execution of scripts.
This rule detects the creation of scheduled tasks using the 'schtasks.exe' utility with command-line arguments indicating persistence triggers ('onlogon', 'onstart') or elevation to the 'SYSTEM' account. Adversaries commonly use these methods to ensure malicious code executes automatically upon system startup or with high privileges to facilitate further exploitation.
This rule detects the creation of scheduled tasks using schtasks.exe that exhibit characteristics associated with the SharkLoader malware. Specifically, it identifies tasks using suspicious names like 'OneDrive Standalone Update Task' or those referencing components dropped in %APPDATA% directories (e.g., \xwreg\, \xgdf\), or tasks masquerading as 'SystemSettings.exe' or 'KasperskyLab' directories.
Detects the creation of scheduled tasks using schtasks.exe that exhibit suspicious characteristics. This includes tasks referencing external URLs, those containing base64-encoded or obfuscated command strings, and tasks pointing to binaries or scripts in user-writable paths (e.g., AppData, Temp). The rule specifically targets tasks intended to run with SYSTEM privileges or those using common persistence triggers, while excluding known legitimate administrative software.
Detects the creation of scheduled tasks using schtasks.exe that point to the ProgramData directory, which is a common persistence location for malware like SystemBC. The rule excludes common, benign software installers and updaters that frequently use this directory to avoid false positives.
Detects the creation of scheduled tasks (schtasks.exe) spawned by common scripting or social engineering-related parent processes (PowerShell, Cmd, WScript, MSHTA). The rule specifically looks for payloads associated with common attack patterns, such as downloading remote content or executing encoded commands, which indicates potential persistence or payload delivery activities.
This rule detects the creation or modification of scheduled tasks using utilities like schtasks.exe or at.exe that are followed by the execution of script-based interpreters (PowerShell, CMD, or WScript). This pattern is commonly indicative of an attacker establishing persistence by scheduling malicious scripts to run automatically.
This rule detects potential tampering with security software processes and services, as well as the execution of suspicious batch scripts (i.bat). It identifies when administrative tools like sc.exe, taskkill.exe, or net.exe are used to stop or delete security agents such as Sysmon, Filebeat, SentinelAgent, or antivirus services. It also monitors for the execution of 'i.bat' via command shell, which is commonly associated with malicious automation or persistence.
Detects coordinated efforts to impair host-based security by disabling Microsoft Defender via Set-MpPreference, terminating security agent processes (e.g., Sysmon, Filebeat, SentinelOne), stopping security services, or executing known security-disabling PowerShell scripts.
Detects the creation of scheduled tasks using the 'schtasks' utility, initiated by suspicious parent processes (browsers, scripting engines, or common tools) or utilizing suspicious task actions (PowerShell, VBScript, etc.) in user-writable directories. Additionally, it flags tasks with high-frequency scheduling or persistence triggers paired with encoded or hidden command-line arguments, which are common indicators of malicious activity such as malware execution or persistence mechanisms.
Detects a post-compromise reconnaissance burst associated with BeepRAT, where a process running from a suspicious directory (AppData, Temp, or ProgramData) executes five or more system discovery commands within a 60-second window, following the creation of a scheduled task on the same host.
Detects the BeepRAT malware using the Tiny C Compiler (tcc.exe) to execute shellcode directly from memory. The rule identifies TCC execution from non-standard directories (specifically within %LOCALAPPDATA%\TCC) using specific flags (-nostdlib -run), and correlates this activity with the creation of an elevated scheduled task named 'WindowsUpdateTempFileCleanUp' used for persistence.
Detects the creation of scheduled tasks using schtasks.exe that involve paths associated with staging (ProgramData, Temp, AppData) or are spawned by suspicious processes like Solid PDF Creator or MediumInstStart. This behavior is indicative of ransomware implant staging or persistence mechanisms used by threat actors.
This rule detects activities associated with the DRAYN malware, specifically the unauthorized modification of Discretionary Access Control Lists (DACLs) on MSP management platform directory archives using icacls, followed by the creation of a scheduled task to establish persistence.
Page 18 of 26