Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
538 detections
Filters
Last updated
All Time
Detection languages
194
92
58
49
47
Contributors
201
94
75
43
39
Categories
408
371
230
67
67
Platforms
523
17
5
3
2
Products / Services
10,665
9,773
6,705
4,421
3,749
538
MITRE Techniques
476
459
443
233
98
CVEs
3
3
1
1
1
Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence
Detects the creation of the 'WSPrint' scheduled task followed by specific registry modifications intended to hide the task from the Task Scheduler UI. This is a known persistence technique used by the UAT-9244 actor for its TernDoor backdoor.
OysterLoader uses a Windows scheduled task to keep itself running. It creates a task with a name that looks like a normal security or updater tool, so it blends in. The task runs repeatedly in the background, helping the malware come back even after a restart and making it harder to notice or remove.
Detects the creation of a scheduled task named 'SoftwareProtection' that executes a Python script. This is a persistence mechanism used by the CrashFix campaign to masquerade as a legitimate Windows service.
Detects persistence mechanisms used by the Interlock RAT, which leverages specific, deceptive scheduled task names related to Defrag, Chkdsk, and TimeSync to maintain a foothold on compromised systems.
This rule detects suspicious scheduled tasks that execute binaries from the AppData\Local folder, which is a common location for user-specific applications and can be abused by adversaries for persistence. Such behavior is often used by Infostealer Malware. The rule specifically looks for processes initiated by 'svchost.exe' or 'taskeng.exe' with command lines indicating scheduled task execution, and then filters out a whitelist of known legitimate applications that operate from this directory. It also incorporates a global prevalence check to further reduce false positives.
The following analytic detects the use of default or publicly known named pipes associated with Cobalt Strike. It leverages Sysmon EventID 17 and 18 to identify specific named pipes commonly used by Cobalt Strike's Artifact Kit and Malleable C2 Profiles. This activity is significant because Cobalt Strike is a popular tool for adversaries to conduct post-exploitation tasks, and identifying its named pipes can reveal potential malicious activity. If confirmed malicious, this could indicate an active Cobalt Strike beacon, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
This analytic detects suspicious data transfer activities involving the use of the `split` syscall with the `-b` option, which specifies the size of each output file. This technique can be used by attackers to evade detection by breaking large files into smaller parts, bypassing size-based security controls, and facilitating covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall with a specified block size, this analytic helps identify potential data exfiltration attempts.
This analytic identifies the bulk creation of ransomware notes (e.g., .txt, .html, .hta files) on an infected machine. It leverages Sysmon EventCode 11 to detect multiple instances of these file types being created within a short time frame (10 seconds). A detection is triggered if 15 or more unique readme paths are observed. This activity is a strong indicator of an active ransomware attack, where the attacker is notifying the victim of the encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering critical files inaccessible and potentially causing significant operational disruption.
The following analytic detects suspicious attempts to find credentials stored in password stores, indicating a potential attacker's effort to access sensitive login information. Password stores are critical repositories that contain valuable credentials, and unauthorized access to them can lead to significant security breaches. By monitoring for unusual or unauthorized activities related to password store access, this analytic helps identify potential credential theft attempts, allowing security teams to respond promptly and prevent unauthorized access to critical systems and data.
The following analytic detects the creation of files in the Windows %startup% folder, a common persistence technique. It leverages the Endpoint.Filesystem data model to identify file creation events in this specific directory. This activity is significant because adversaries often use the startup folder to ensure their malicious code executes automatically upon system boot or user logon. If confirmed malicious, this could allow attackers to maintain persistence on the host, potentially leading to further system compromise and unauthorized access to sensitive information.
Detects the creation of scheduled tasks that involves a temporary folder and runs only once
The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem data model to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity is significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unusale program to be run from a Scheduled Task
Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is an unusual program to be run from a Scheduled Task
Detects suspicious DACL modifications to deny access to a service that affects critical trustees. This can be used to hide services or make them unstoppable.
Detects creation of a scheduled task with a GUID like name
Detects the creation of new scheduled tasks via commandline, using Schtasks.exe. This rule detects tasks creating that call OpenSSH, which may indicate the creation of reverse SSH tunnel to the attacker's server.
Detects manual execution of the "Microsoft Compatibility Appraiser" task via schtasks.
In order to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.
In order to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.
Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell "Get-Variable" technique as seen being used in Colibri Loader
Detect the creation of a service with a service binary located in a suspicious directory
Page 23 of 26