Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,053 detections
Filters
Last updated
All Time
Detection languages
502
165
78
75
69
Contributors
326
184
158
51
46
Categories
20,456
11,839
5,876
5,155
4,865
1,053
Platforms
929
119
24
11
4
Products / Services
408
279
229
194
114
MITRE Techniques
1,019
1,002
879
616
183
CVEs
2
1
1
1
1
IDS Classtypes
5
4
2
1
IDS Protocols
8
4
This rule detects persistence mechanisms associated with the SystemBC/Coroxy malware. It monitors for three indicators: 1) The creation of scheduled tasks via 'schtasks.exe' where the task binary is located in 'ProgramData' and uses the 'start' argument; 2) Windows Security Event ID 4698 (Scheduled Task Created) identifying similar task actions in 'ProgramData' with the 'start' argument; 3) The creation of Registry Run keys in 'HKCU' or 'HKLM' with values containing 'ProgramData' combined with malicious arguments such as 'start', '-windowstyle hidden', or '-ep bypass'.
Detects the creation of files within the Windows startup directory or Windows tasks folder. The rule specifically excludes known system binaries like schtasks.exe and mstask.exe to reduce noise, and attempts to categorize the artifacts based on specific naming patterns.
Detects instances where the Claude Code AI agent or its subprocesses are used to establish persistence. This is achieved by monitoring for crontab modifications or direct writes to SSH authorized_keys files, which are common indicators of post-exploitation activity following an Axiom-style indirect prompt injection.
Detects the creation of scheduled tasks (via schtasks.exe or at.exe) directly by known AI agent developer binaries (e.g., claude, cursor, aider) or indirectly via command shells spawned by these agents. This behavior may indicate an AI agent being leveraged to establish persistence or automate malicious actions on a host.
Detects persistence mechanisms frequently associated with SharkLoader and Cobalt Strike. The rule monitors for scheduled task creation using specific suspicious naming patterns, tasks pointing to SystemSettings.exe in non-standard directories (AppData/ProgramData), high-frequency task triggers, and registry run key modifications targeting SystemSettings.exe in similar suspicious paths.
Detects indicators of persistence on Linux systems, specifically targeting unauthorized cron job creation/deletion in /etc/cron.d/, execution of suspicious shell scripts (ssync.sh), modification of startup scripts (e.g., /etc/rc.d/cron), and execution of binaries from world-writable directories by cron or system daemons. This rule is designed to identify the footprint of known Linux-based persistence mechanisms associated with service account exploitation.
Detects the creation of suspicious scheduled tasks by potentially malicious processes (e.g., winupdate.exe or processes running from AppData/.cache or Temp directories). The rule monitors for schtasks.exe usage that either targets specific persistence locations or creates tasks naming conventions (e.g., 'WindowsDefenderAgent') often associated with the Yuta/Glove Stealer malware family.
Detects malicious persistence mechanisms using the Windows Task Scheduler, specifically targeting the creation or execution of 'TPMProfiler' or 'qemu-system-x86_64.exe' under high-privilege accounts (SYSTEM). This rule monitors for schtasks.exe task creation, anomalous parent-child process relationships involving task host processes, and unauthorized module loads of taskschd.dll associated with QEMU activity.
This rule detects the creation of a scheduled task via schtasks.exe using parameters often associated with malicious persistence mechanisms, such as running as SYSTEM, requiring highest privileges, or placing task actions in directories like Temp, AppData, or Public. This behavior is consistent with tactics used by various threat actors, including UNC1549/MiniJunk, to maintain persistence.
Detects potential privilege escalation and unauthorized file modification by the 'egnyteservice' account. The rule monitors Syslog for sudo usage involving the 'tee' utility with 'NOPASSWD' configuration, or suspicious writes to critical system directories such as /usr/sbin/ and /etc/cron.d/, which are indicative of VerdantBamboo threat actor activity on edge appliances.
Detects the creation of scheduled tasks that involve QEMU virtualization binaries or virtual disk images. This activity is associated with the GOLD ENCOUNTER threat group and campaigns STAC4713/STAC3725, which utilize QEMU to facilitate persistence and infrastructure defense evasion by maintaining virtualized environments across system reboots.
Detects the creation of scheduled tasks that use `schtasks.exe` to execute `rundll32.exe`. This is a common technique used by attackers for persistence and to execute malicious DLLs, often to bypass application whitelisting or other security controls.
Detects the creation of scheduled tasks named 'MicrosoftEdgeUpdate' or 'MicrosoftEdge' that execute files located in non-standard directories such as ProgramData or Temp. This is a common technique used by threat actors to achieve persistence while masquerading as legitimate update services.
This rule detects the creation or configuration of a scheduled task named 'GoogleErrorReport' which references 'Fondue.exe' located in the 'C:\Users\Public' directory. This specific pattern is associated with 'Dropping Elephant' malware persistence, where the task ensures the binary executes persistently on the host.
This rule monitors for suspicious activity originating from RMM software (specifically SimpleHelp) and associated TaskWeaver processes, including process execution, service/scheduled task installation, file creation consistent with Djinn Stealer, and non-standard outbound network connections.
This rule detects the creation of suspicious scheduled tasks using either the schtasks command or through the system's scheduled task service. It focuses on task actions originating from suspicious parent processes (such as browsers or script interpreters), tasks executing scripts from writable user directories, or tasks with persistence triggers (e.g., /SC MINUTE, /SC ONLOGON) containing encoded PowerShell commands or hidden window styles indicative of malicious activity.
Detects the execution of schtasks.exe originating from Windows system management or package management server processes (ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe). This activity may indicate administrative task automation or potentially malicious persistence and execution attempts using legitimate system binaries.
Detects suspicious command execution on Linux-based SOHO/IoT devices, specifically targeting patterns associated with log deletion, unauthorized cron job modification, busybox utility abuse, and temporary directory execution. This activity is often linked to botnet recruitment and reconnaissance behaviors such as those observed in the JDY and Volt Typhoon campaigns.
This rule detects the creation of scheduled tasks (Event ID 4697) where the command line contains either 'System' or 'Admin'. This could indicate an attempt to create a scheduled task that runs with elevated privileges or impersonates system/admin accounts for persistence or privilege escalation.
Detects the creation of scheduled tasks using schtasks.exe by processes that are not digitally signed by Microsoft Corporation, as well as the loading of taskschd.dll by non-standard/unsigned processes. This behavior is indicative of potential persistence mechanisms or unauthorized task scheduling activity.
Detects the creation of new scheduled tasks using the Windows schtasks.exe command-line utility. This behavior is commonly used by adversaries for persistence by ensuring malicious payloads, loaders, or backdoors are re-executed upon system events or intervals.
Page 24 of 51