Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
538 detections
Filters
Last updated
All Time
Detection languages
194
92
58
49
47
Contributors
201
94
75
43
39
Categories
408
371
230
67
67
Platforms
523
17
5
3
2
Products / Services
10,665
9,773
6,705
4,421
3,749
538
MITRE Techniques
476
459
443
233
98
CVEs
3
3
1
1
1
This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. Threat actors like Static Tundra have been observed configuring TFTP servers to make device configuration files accessible for exfiltration after gaining initial access. The detection specifically looks for commands that expose critical configuration files such as startup-config, running-config, and other sensitive system information through TFTP. This activity is particularly concerning as it may represent an attempt to steal credentials, network topology information, and other sensitive data stored in device configurations.
The following analytic detects the creation or connection of anonymous pipes for inter-process communication (IPC) within a Windows environment. Anonymous pipes are commonly used by legitimate system processes, services, and applications to transfer data between related processes. However, adversaries frequently abuse anonymous pipes to facilitate stealthy process injection, command-and-control (C2) communication, credential theft, or privilege escalation. This detection monitors for unusual anonymous pipe activity, particularly involving non-system processes, unsigned executables, or unexpected parent-child process relationships. While legitimate use cases exist—such as Windows services, software installers, or security tools—unusual or high-frequency anonymous pipe activity should be investigated for potential malware, persistence mechanisms, or lateral movement techniques.
The analytic detects potentially suspicious modifications to Windows Audit Policy auditing options registry values. It focuses on changes to specific auditing option values ("CrashOnAuditFail", "FullPrivilegeAuditing", "AuditBaseObjects", "AuditBaseDirectories") within the "HKLM\System\CurrentControlSet\Control\Lsa\" registry key. Such modifications could indicate a threat actor attempting to tamper with audit policy configurations, potentially disabling SACLs (System Access Control Lists) to bypass defenses and facilitate further malicious activities like machine compromise or lateral movement.
Generic rule content from file: Hunting Scheduled Tasks
winevent 4698
winevent 4698
Detects Matanbuchus Malware Loader (IOCs) including file hashes, a scheduled task name, domains, and an IP address.
Detects the creation of scheduled tasks (event ID 4698) where the task content includes references to potentially suspicious file paths and execution of known Living-off-the-Land Binaries and Scripts (LOLBAS). These behaviors are commonly associated with persistence mechanisms used by threat actors or malware.
This rule detects suspicious creation or modification of Windows Scheduled Tasks via direct changes to the Registry, as captured by Sysmon Event IDs 12, 13, and 14. Adversaries often use this technique to establish persistence by creating malicious tasks that run at system startup or on a scheduled basis. The rule monitors the TaskCache registry paths specifically Tasks and Tree keys and excludes known legitimate operations by trusted system processes and users (e.g., taskhostw.exe, svchost.exe, SYSTEM, and service accounts) to reduce false positives.
This query detects potential Fox Kitten threat actor activity by analyzing ScheduledTaskCreated events.
It filters for suspicious task names (e.g., "update", "sync", "\Microsoft\Windows\EnterpriseMgmt"), non-system accounts, and risky commands (e.g., powershell, certutil). It also extracts task details, assigns risk levels (HIGH, MEDIUM, LOW) based on command patterns, and orders results by risk and timestamp for prioritized investigation.
It filters for suspicious task names (e.g., "update", "sync", "\Microsoft\Windows\EnterpriseMgmt"), non-system accounts, and risky commands (e.g., powershell, certutil). It also extracts task details, assigns risk levels (HIGH, MEDIUM, LOW) based on command patterns, and orders results by risk and timestamp for prioritized investigation.
KQL Query
The analytic detects the use of the Win32_ScheduledJob WMI class via PowerShell script block logging. This class, which manages scheduled tasks, is disabled by default due to security concerns and must be explicitly enabled through registry modifications. The detection leverages PowerShell event code 4104 and script block text analysis. Monitoring this activity is crucial as it may indicate malicious intent, especially if the class was enabled by an attacker. If confirmed malicious, this could allow attackers to persist in the environment by creating scheduled tasks.
Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is an unusual program to be run from a Scheduled Task
Directly prior to deploying Macaw ransomware in an organization, the attacker will run several commands designed to disable security tools and system recovery tools.
This query looks for signs of impacket atexec module. Should work with others using similar technique.
Author: Jouni Mikkola
More info: https://threathunt.blog/impacket-part-3/
Author: Jouni Mikkola
More info: https://threathunt.blog/impacket-part-3/
Looks for rare process launch as a scheduled task and activity done by the processes.
Author: Jouni Mikkola
More info: https://threathunt.blog/hunting-for-malicious-scheduled-tasks/
Author: Jouni Mikkola
More info: https://threathunt.blog/hunting-for-malicious-scheduled-tasks/
Hunts for known SVR-specific scheduled task names
This rule detects rare scheduled task creations. Typically software gets installed on multiple systems and not only on a few. The aggregation and count function selects tasks with rare names.
Detects when adversaries try to stop system services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities
Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unusale program to be run from a Scheduled Task
This query was originally published in the threat analytics report, Sysrv botnet evolution.
Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.
The following query finds instances of Apache Tomcat 8 being exploited to execute encoded PowerShell commands.
Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.
The following query finds instances of Apache Tomcat 8 being exploited to execute encoded PowerShell commands.
This analytic detects suspicious modifications to Unix shell configuration files, such as `.bashrc` or `.profile`, which may indicate an attempt to alter system behavior or gain unauthorized access. Unauthorized changes to these files can be used to execute malicious commands, escalate privileges, or hide malicious activities. By monitoring for unusual or unauthorized modifications to shell configuration files, this analytic helps identify potential security threats, allowing security teams to respond quickly and mitigate risks.
The following analytic detects attempts to stop a service on Linux systems. It leverages data from Linux Auditd. This activity is significant as adversaries often stop or terminate security or critical services to disable defenses or disrupt operations, as seen in malware like Industroyer2. If confirmed malicious, this could lead to the disabling of security mechanisms, allowing attackers to persist, escalate privileges, or deploy destructive payloads, severely impacting system integrity and availability.
Page 24 of 26