Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
538 detections
Filters
Last updated
All Time
Detection languages
194
92
58
49
47
Contributors
201
94
75
43
39
Categories
408
371
230
67
67
Platforms
523
17
5
3
2
Products / Services
10,665
9,773
6,705
4,421
3,749
538
MITRE Techniques
476
459
443
233
98
CVEs
3
3
1
1
1
Detects the creation of Windows scheduled tasks using schtasks.exe that exhibit high-risk indicators, such as targeting temporary or user-writable directories (Temp, AppData), setting high-privilege execution flags, or utilizing PowerShell with encoded payloads. These behaviors are commonly associated with the installation of persistence mechanisms by threat actors.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility that point to suspicious script execution, encoded commands, or files located in commonly abused writable directories like Temp or ProgramData. This behavior is indicative of potential persistence mechanisms.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility that point to suspicious script execution, encoded commands, or files located in commonly abused writable directories like Temp or ProgramData. This behavior is indicative of potential persistence mechanisms.
Detects the creation or execution of a scheduled task named 'CreateObjectTask' via schtasks or PowerShell, which is associated with spawning 'dllhost.exe' as a child process under high-privileged parent processes (svchost, taskeng, or schtasks). This behavior is indicative of potential COM hijacking or privilege escalation techniques leveraging system tasks.
Detects the creation of a scheduled task via schtasks.exe initiated by wscript.exe or cscript.exe where the task configuration or execution occurs within common user-writable directories (e.g., AppData, Temp, Downloads). The rule specifically flags behavior involving multiple task invocations in a short time frame, which is indicative of persistence mechanisms used by scripts.
This rule detects the loading of a driver named 'eb.sys' (or matching a specific SHA256 hash) paired with the creation of a Windows service for that driver via the 'sc' command. This behavior is indicative of potential rootkit installation or driver-based persistence mechanisms.
Detects the creation of scheduled tasks using schtasks.exe or Event ID 4698, specifically filtering for tasks that execute PowerShell, WScript, or JavaScript files. This behavior is indicative of potential persistence mechanisms, such as those observed in the LausivLoader.
This rule detects the creation or registration of scheduled tasks using common scripting engines (PowerShell, WScript, CScript) or specific task name patterns (MicrosoftEdgeUpdateTaskCore, PhotoStudio.js) often associated with malicious persistence or execution. It monitors command lines for flags such as /create, /sc onlogon, or /ru system that suggest non-standard or unauthorized task creation patterns.
Detects suspicious PowerShell activity involving compression commands (e.g., Expand-Archive) within APPDATA, correlated with the execution of hypersnap.exe with hidden window arguments, and the creation of persistence via scheduled tasks. This pattern is indicative of automated staging or malicious tool execution and persistence setup.
Detects the creation of scheduled tasks initiated by the WinGet DSC configuration processes, specifically ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe. This activity is indicative of the abuse of the 'ScheduledTask' resource within a WinGet configuration file to establish persistence via a logon-triggered task.
Detects the creation of a suspicious scheduled task named 'MicrosoftMusicLibrariesPackageTaskMachine' and the execution of 'codeflush.exe' involving 'settingenv.cat'. These activities are associated with persistence and defense evasion techniques often used by malicious actors.
Detects the creation or execution of a scheduled task named 'MicrosoftMusicLibrariesPackageTaskMachine' and the invocation of specific associated file names 'codeflush.exe' or 'settingenv.cat', which are indicators of persistence used by the threat actor APT37.
Detects the creation of scheduled tasks using schtasks.exe or PowerShell that reference specific task names associated with potentially suspicious activity or persistence (e.g., PlutonAgentScheduler, EnterpriseMgmtServicesScheduler). The rule specifically looks for tasks being placed or modified within 'microsoft' or 'pluton' directories or paths, which may indicate an attempt to masquerade as legitimate system services.
Detects the creation of scheduled tasks using schtasks.exe or PowerShell that reference specific task names associated with potentially suspicious activity or persistence (e.g., PlutonAgentScheduler, EnterpriseMgmtServicesScheduler). The rule specifically looks for tasks being placed or modified within 'microsoft' or 'pluton' directories or paths, which may indicate an attempt to masquerade as legitimate system services.
Detects MayaBot's scheduled-task persistence chain by correlating two signals on the same device within a 60-minute window: (1) schtasks.exe creating a daily task referencing a hidden batch script (update.bat/backup.bat/firewall-update.bat) under AppData\Local, spawned from wscript.exe/cscript.exe/cmd.exe, and (2) cmd.exe launching a hidden-window PowerShell process referencing the same batch scripts under AppData\Local. Requiring both signals together, anchored to the AppData\Local path, sharply reduces false positives compared to alerting on either behavior alone.
Detects MayaBot's scheduled-task persistence chain by correlating two signals on the same device within a 60-minute window: (1) schtasks.exe creating a daily task referencing a hidden batch script (update.bat/backup.bat/firewall-update.bat) under AppData\Local, spawned from wscript.exe/cscript.exe/cmd.exe, and (2) cmd.exe launching a hidden-window PowerShell process referencing the same batch scripts under AppData\Local. Requiring both signals together, anchored to the AppData\Local path, sharply reduces false positives compared to alerting on either behavior alone.
Detects the creation of scheduled tasks using schtasks.exe initiated by command shells where the task command points to files residing in non-standard or user-writable directories such as \Users\Public\, \PerfLogs\, or \ProgramData\. This pattern is frequently utilized by malware loaders like SocGholish, GootLoader, and various ransomware strains to achieve persistence following initial compromise.
Detects a multi-stage installation of the Level RMM agent. This rule monitors for a correlation of events including the execution of 'LevelInstaller.exe' with specific installation arguments, file drops in potentially spoofed vendor paths (Dell or Level), the creation of a 'Level' service, and the addition of a 'Level Watchdog' scheduled task on the same device within a 24-hour window.
Detects the creation of scheduled tasks using schtasks.exe that are configured to run every minute, specifically targeting command lines associated with known suspicious processes like 'codeflush.exe' or potentially masqueraded music library tasks.
Detects the creation of a scheduled task configured to run under SYSTEM or a Service account, where the triggering process is not a recognized system binary (e.g., taskeng.exe, schtasks.exe). This pattern is often used for persistence or lateral movement by bypassing standard administrative task creation tools.
Detects the installation of a new kernel-mode service using system utilities like sc.exe, cmd.exe, or powershell.exe, which is a common indicator of a Bring Your Own Vulnerable Driver (BYOVD) attack intended to gain kernel-level privileges.
Page 5 of 26