Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,053 detections
Filters
Last updated
All Time
Detection languages
502
165
78
75
69
Contributors
326
184
158
51
46
Categories
20,456
11,839
5,876
5,155
4,865
1,053
Platforms
929
119
24
11
4
Products / Services
408
279
229
194
114
MITRE Techniques
1,019
1,002
879
616
183
CVEs
2
1
1
1
1
IDS Classtypes
5
4
2
1
IDS Protocols
8
4
Detects the creation of a hidden scheduled task using the Schedule.Service COM object, where the author field is explicitly set to 'Microsoft Corporation' to masquerade as a legitimate system task.
Detects the creation of a scheduled task named 'Photo Studio' or the execution of a VBScript file named 'PhotoStudio.vbs' located within a 'PhotoStudioVBS' folder, which are artifacts associated with the Blind Eagle (APT-C-36) threat group to maintain persistence.
Detects the creation of scheduled tasks using PowerShell commands that incorporate execution policy bypass and hidden window styling. This pattern is commonly observed in malware loaders and persistence mechanisms to minimize visual indicators during execution.
Detects potential persistence mechanisms that mimic or leverage the Microsoft OneDrive update process. This includes the creation or modification of scheduled tasks containing 'OneDrive Update' in the command line using tools like schtasks or PowerShell, as well as modifications to the HKCU OneDrive environment registry key, a behavior associated with the GigaWiper malware.
Detects various stages of the Armored Likho APT campaign using the BusySnake stealer, including lure archive delivery, NSIS droppers, LNK shortcut abuse, PowerShell-based staging, VBScript persistence, scheduled task creation, reverse SSH tunneling, and exfiltration of browser and communication artifacts.
Detects the creation of Windows Scheduled Tasks that follow the 'PythonLauncher-' naming convention, often associated with Starland RAT, using PowerShell commands such as Register-ScheduledTask. The rule monitors for persistence mechanisms configured to run at logon or with highest privileges.
Detects the creation of scheduled tasks using specific, suspicious task names associated with the CURP threat campaign. This rule monitors for 'schtasks.exe' command line executions involving the creation of tasks with names 'brokerhost' or 'net_queue_32', which are identified as indicators of persistent threat activity.
Detects crontab modifications referencing hw_probe.pyc, the cron-based persistence mechanism used by the mrmustard stealer.
Detects potential persistence mechanisms that mimic or leverage the Microsoft OneDrive update process. This includes the creation or modification of scheduled tasks containing 'OneDrive Update' in the command line using tools like schtasks or PowerShell, as well as modifications to the HKCU OneDrive environment registry key, a behavior associated with the GigaWiper malware.
Detects the creation of scheduled tasks using PowerShell commands that incorporate execution policy bypass and hidden window styling. This pattern is commonly observed in malware loaders and persistence mechanisms to minimize visual indicators during execution.
Detects the creation or registration of scheduled tasks involving the suspicious artifact 'SolidPDFPcl2Bmp'. This monitoring covers process executions using schtasks.exe or reg.exe, registry modifications to the Windows Task Scheduler cache, and file drops within the Windows System32 Tasks directory, which are common indicators of persistence establishment via scheduled tasks.
Detects the creation of a crontab entry configured to execute a Python one-liner that performs a network connection to a specific remote IP address on port 4444. This behavior is indicative of a persistence mechanism and a C2 (Command and Control) beaconing attempt.
Detects the creation or modification of persistence mechanisms (Windows Registry Run/RunOnce keys, Cron jobs, Systemd services, and macOS LaunchAgents/LaunchDaemons) that specifically reference Java executables or .jar files. This pattern is consistent with cross-platform malware such as QuimaRAT attempting to maintain persistence.
Detects the creation of a scheduled task via PowerShell using 'Register-ScheduledTask' configured to run as the SYSTEM account at system startup. The detection specifically identifies tasks with dynamically generated hexadecimal names (8-20 characters), a technique associated with the persistence mechanism of Banana RAT.
Detection logic covering multiple stages of the Gentlemen ransomware attack lifecycle, including reconnaissance, defense impairment (disabling Defender/EDR), persistence, lateral movement using GPO and PsExec, and anti-forensic activities such as shadow copy deletion and log clearing.
Detects the creation of a scheduled task using 'schtasks.exe' where the command line includes a specific security descriptor string '(A;;GA;;;WD)' indicating full access (GA) is granted to everyone (WD). This is a known technique used to ensure the created task has broad permissions for persistence or privilege escalation, often associated with bypassing security controls.
Detects the creation of a scheduled task using schtasks.exe that involves the string 'CrysomeLoader' in the command line, which is indicative of persistence or execution mechanisms associated with the CrysomeLoader malware.
Detects the creation or modification of cron jobs initiated by processes associated with the OpenClaw or ClawHub platforms. This behavior is indicative of a persistence mechanism being established by these applications, which may be leveraged by attackers if the processes themselves are compromised or malicious.
Detection logic covering multiple stages of the Gentlemen ransomware attack lifecycle, including reconnaissance, defense impairment (disabling Defender/EDR), persistence, lateral movement using GPO and PsExec, and anti-forensic activities such as shadow copy deletion and log clearing.
Detects the creation of a Windows scheduled task named 'WindowsHelper' that is configured to execute a 'run.vbs' script via wscript.exe every five minutes. This behavior is associated with the persistence mechanism used by the Armored Likho BusySnake Stealer malware.
Detects the creation of scheduled tasks using schtasks.exe where the command line includes indicators associated with potential malicious binaries or tools. Monitoring for these specific filenames in task creation can identify persistence mechanisms or authorized task scheduling abuse.
Page 22 of 51