Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,053 detections
Filters
Last updated
All Time
Detection languages
502
165
78
75
69
Contributors
326
184
158
51
46
Categories
20,456
11,839
5,876
5,155
4,865
1,053
Platforms
929
119
24
11
4
Products / Services
408
279
229
194
114
MITRE Techniques
1,019
1,002
879
616
183
CVEs
2
1
1
1
1
IDS Classtypes
5
4
2
1
IDS Protocols
8
4
Detects the creation of a scheduled task containing the string 'Google Chrome Update' in the command line, where the task is not the legitimate 'GoogleUpdateTaskMachine' task. The rule specifically targets tasks that execute PowerShell or arbitrary executables, which is a common persistence technique used by adversaries to mask malicious tasks as legitimate software updates.
Detects the creation of scheduled tasks that masquerade as a 'Google Chrome Update' task but are initiated by suspicious processes like cmd.exe, powershell.exe, or schtasks.exe, and do not originate from the legitimate Google Chrome installation directories.
This rule detects the creation of Windows scheduled tasks using the 'schtasks.exe' utility or events generated when a task is registered. This technique is commonly used for persistence and execution by adversaries.
This rule detects the creation of Windows Scheduled Tasks by monitoring for Event ID 4698 (Windows Security Log) or Sysmon Event ID 1 (Process Creation) that involves task name parameters. Adversaries frequently use the Windows Task Scheduler to establish persistence, execute malicious code, or run tasks at system startup.
Detects the creation of a scheduled task named 'keyroll', which is associated with the persistence mechanism of Sauron Loader. The task is used to launch a DLL side-loading chain involving rnpkeys.exe and tdwp.dll.
Detects the creation of a scheduled task named 'MicrosoftEdgeUpdateTaskCore' that is configured to execute a malicious JavaScript file named 'PhotoStudio.js' using wscript.exe with silent flags. This behavior is indicative of persistence mechanisms employed by the LausivLoader malware family.
Detects the creation or execution of scheduled tasks named 'MicrosoftEdgeUpdateTaskCore' that exhibit suspicious behaviors, specifically those marked as hidden, tasks utilizing a LogonTrigger, or tasks executing wscript.exe with specific command-line arguments (e.g., //B, //Nologo) often associated with malicious script execution patterns.
This rule detects multiple distinct methods of modifying, impairing, or disabling Microsoft Defender Antivirus exclusions and tamper protection settings. It identifies suspicious activity through PowerShell commands (Add-MpPreference, Set-MpPreference, Invoke-CimMethod, TamperProtection modification), direct registry modification of Defender exclusion paths, and the use of scheduled tasks to maintain or enforce these changes. The rule flags endpoints where two or more of these distinct techniques are observed in a 24-hour period.
Detects the creation of scheduled tasks using schtasks.exe or PowerShell that masquerade as legitimate Microsoft Edge or OneDrive update tasks. This behavior is associated with APT36 (Transparent Tribe) and their use of modular malware to establish persistence.
Detects malicious scheduled task creation using names associated with Microsoft Edge updates, or the execution of PowerShell commands that utilize encoded arguments and known APT36 download cradles, indicating an attempt to establish persistence or retrieve secondary payloads.
Detects the creation of scheduled tasks using either 'schtasks.exe' or 'powershell.exe' (Register-ScheduledTask) where the task name or configuration references common update or startup task patterns, or contains indicators of potential process hiding or encoded command execution.
Detects MayaBot's scheduled-task persistence chain by correlating two signals on the same device within a 60-minute window: (1) schtasks.exe creating a daily task referencing a hidden batch script (update.bat/backup.bat/firewall-update.bat) under AppData\Local, spawned from wscript.exe/cscript.exe/cmd.exe, and (2) cmd.exe launching a hidden-window PowerShell process referencing the same batch scripts under AppData\Local. Requiring both signals together, anchored to the AppData\Local path, sharply reduces false positives compared to alerting on either behavior alone.
Detects the creation of scheduled tasks using schtasks.exe that are configured to repeat every minute, specifically targeting known malicious or suspicious filenames such as 'MicrosoftUserInterfacePicturesUpdateTackMachine', 'userscreen.exe', or 'config.cat'. The rule monitors both process creation command lines and registry modifications within the Windows Task Scheduler tree.
Detects the creation of files within the /etc/cron.d/ directory initiated by the redis-server process, specifically looking for malicious payloads containing bash -c and /dev/tcp/ command wrappers indicative of a reverse shell or beaconing persistence mechanism often used by Redis-targeting botnets.
Detects ROOFDECK backdoor persistence via macOS Launch Agents, tightened to require the implant's distinguishing masquerade artifacts (fake Apple-service drop paths, --type=renderer flag, loginwindow.plist impersonation, or the literal 'persist add|remove|check' CLI syntax) rather than generic LaunchAgents plist creation or launchctl load activity, which legitimate macOS software triggers constantly.
Detects the execution of binaries or scripts named with keywords related to AI agent plugins (e.g., 'skill', 'plugin', 'mcp-server') from potentially untrusted locations like Downloads or Temp folders. The rule further correlates this execution with post-exploitation indicators such as persistence establishment (registry keys, scheduled tasks, launch agents) or outbound network activity.
Detects creation of the 'keyroll' scheduled task used to relaunch the Sauron Loader DLL side-loading chain. Requires the schtasks.exe command line to both reference the 'keyroll' task name AND explicitly reference the ProgramData\keyroll path or rnpkeys.exe (ruling out unrelated tasks that happen to be named 'keyroll', e.g. legitimate key-rotation automation), and requires an INNER join corroborating an actual rnpkeys.exe relaunch from that path within 24h — a lone task-creation event with no follow-on relaunch no longer alerts.
Detects various persistence mechanisms used by the CARBONATO botnet on Linux systems, including registration of cron jobs, systemd services/timers, and the usage of 'chattr +i' to make persistence files immutable.
Detects the creation of a scheduled task using schtasks.exe where the command line involves 'MicrosoftNodeRuntimeUpdater' and references 'node.exe' or '.js' files, specifically when initiated by script engines like node.exe, wscript.exe, or cscript.exe, while excluding known legitimate nodejs installation paths.
Detects the creation of a scheduled task using the schtasks utility where the execution principal is set to SYSTEM. This pattern is commonly observed in malware such as DragonForce ransomware to establish persistence or execute payloads with elevated privileges.
Detects the creation of a scheduled task configured to run under the SYSTEM account that executes a command to add a Windows Defender exclusion using Add-MpPreference. This technique is often used to ensure persistence of security exclusions by re-applying them automatically with high privileges, even if an interactive user attempts to remove them.
Page 12 of 51