Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
538 detections
Filters
Last updated
All Time
Detection languages
194
92
58
49
47
Contributors
201
94
75
43
39
Categories
408
371
230
67
67
Platforms
523
17
5
3
2
Products / Services
10,665
9,773
6,705
4,421
3,749
538
MITRE Techniques
476
459
443
233
98
CVEs
3
3
1
1
1
Detects potential persistence attempts on Windows systems where an unsigned executable, located in a user-writable directory (Temp, AppData, Downloads), is either configured for automatic startup via Registry run keys or registered as a scheduled task.
Detects potential persistence mechanisms associated with SharkLoader or similar malware campaigns. The rule monitors for unauthorized modification of Windows Run registry keys by non-Microsoft signed processes, the creation of suspicious scheduled tasks masquerading as legitimate update tasks (e.g., OneDrive or Microsoft updates), and the execution of processes from common malware working directories like 'AppData/Roaming/xwreg' or 'AppData/Roaming/xgdf'.
Detects the creation or modification of scheduled tasks that either utilize user-writable directories (e.g., AppData, Temp) for task execution or mimic the naming convention of 'OneDrive Standalone Update' tasks. This behavior is indicative of persistence mechanisms used by the StrikeShark campaign to deploy SharkLoader and related payloads, such as Cobalt Strike.
Detects the creation of a scheduled task named 'RageGuard' correlated with commands known to inhibit system recovery, such as modifying boot configuration with bcdedit or deleting volume shadow copies/backups using vssadmin or wbadmin, within the same process execution chain.
This rule detects the creation or modification of scheduled tasks using utilities like schtasks.exe or at.exe that are followed by the execution of script-based interpreters (PowerShell, CMD, or WScript). This pattern is commonly indicative of an attacker establishing persistence by scheduling malicious scripts to run automatically.
Detects the creation of a scheduled task by the Potemkin Loader using the 'schtasks.exe' utility. The rule specifically looks for command lines containing task creation flags combined with an executable path located within 'AppData' directories, which is a common persistence mechanism for this loader.
Detects the creation of scheduled tasks using 'schtasks.exe' with names that mimic legitimate Microsoft services such as 'RealtekAudio', 'CoreUIComponents', 'OneDriveHealthTask', or 'WindowsUpdate'. This technique is often used by adversaries for persistence.
Detects the creation of scheduled tasks using schtasks.exe that masquerade as common update tasks (Google, Microsoft) or point to suspicious file paths often associated with malware (e.g., C:\ProgramData\VMware\). The rule monitors for tasks created with high privileges or triggers, which are indicative of persistence mechanisms.
Detects the creation of scheduled tasks that masquerade as legitimate update processes (e.g., Microsoft Edge, Google Updater) using elevated privileges (/rl highest) and triggering on system logon (/sc onlogon). The rule specifically flags tasks associated with suspicious paths or binary names like VMWare or PerfWatson to identify potential persistence or execution mechanisms.
Detects the creation of scheduled tasks using specific Mozilla-related naming patterns ('\Mozilla\UpdateTask' or '\Mozilla\ElevateTask') that execute with SYSTEM privileges, a behavior associated with Payouts King ransomware persistence mechanisms.
Detects the creation of suspicious scheduled tasks used by the StrikeShark campaign for persistence. These tasks are named with a prefix mimicking OneDrive updates ('OneDrive Standalone Update Task-S-1-') and are configured to execute SystemSettings.exe from specific AppData subdirectories ('xwreg' or 'xgdf'). The rule correlates process execution logs and scheduled task creation events to identify the dropper activity.
Detects the creation of scheduled tasks using schtasks.exe that exhibit suspicious characteristics. This includes tasks referencing external URLs, those containing base64-encoded or obfuscated command strings, and tasks pointing to binaries or scripts in user-writable paths (e.g., AppData, Temp). The rule specifically targets tasks intended to run with SYSTEM privileges or those using common persistence triggers, while excluding known legitimate administrative software.
Detects the creation of scheduled tasks (schtasks.exe) spawned by common scripting or social engineering-related parent processes (PowerShell, Cmd, WScript, MSHTA). The rule specifically looks for payloads associated with common attack patterns, such as downloading remote content or executing encoded commands, which indicates potential persistence or payload delivery activities.
Identifies the creation of scheduled tasks masquerading as Realtek audio services for persistence, often associated with AsyncRAT.
Detects the creation of a scheduled task using 'schtasks' with 'SYSTEM' privileges, masquerading as Adobe or OneDrive, and pointing to an executable in a user-writable path (Temp, AppData, ProgramData, or Users\Public). This pattern is often used by adversaries for persistence or privilege escalation.
Detection of scheduled tasks like DiskDiagnosticDataCollector created by GammaWorm to launch ADS payloads.
This rule detects the creation of scheduled tasks or 'at' jobs initiated by VBScript engines (wscript.exe or cscript.exe). This behavior can be indicative of malicious activity, such as persistence mechanisms established by malware or phishing attacks that leverage VBScript to schedule future execution.
Detects the creation of a scheduled task named 'SoftwareProtection' that executes a Python payload, indicative of ModeloRAT persistence.
Detects the creation of a scheduled task named 'Microsoft Display Manager' using schtasks.exe. This specific task name is associated with the BoldTealLayer malware loader, which uses this persistence mechanism when running with administrative privileges.
Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities
Detects usage of bitsadmin downloading a file using an URL that contains an IP
Page 22 of 26