Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,053 detections
Filters
Last updated
All Time
Detection languages
502
165
78
75
69
Contributors
326
184
158
51
46
Categories
20,456
11,839
5,876
5,155
4,865
1,053
Platforms
929
119
24
11
4
Products / Services
408
279
229
194
114
MITRE Techniques
1,019
1,002
879
616
183
CVEs
2
1
1
1
1
IDS Classtypes
5
4
2
1
IDS Protocols
8
4
Detects the creation of scheduled tasks using the Windows schtasks utility where the task action points to a file located in common user-writable directories such as AppData, Temp, Users\Public, or Downloads. This behavior is frequently associated with persistence mechanisms used by malware and backdoors.
Detects execution of persistence-related commands such as cron job modifications or SSH key additions originating from development-related parent processes or installation commands like npm/pip. This behavior is indicative of potential supply chain compromises or malicious actors abusing development environments to maintain access.
Detects the BeepRAT malware establishing persistence by creating a scheduled task named 'WindowsUpdateTempFileCleanUp' via 'schtasks.exe'. The task is configured to execute a malicious loader chain using the Tiny C Compiler to run a hidden config file, often spawned from a binary named 'HFY.exe'.
This rule detects potential persistence mechanisms by monitoring the creation of scheduled tasks using the 'schtasks' utility or modifications to Windows Registry 'Run' keys, specifically targeting suspicious paths (AppData, Temp, or ProgramData). The detection logic correlates these suspicious persistence artifacts with network activity by joining the events with Sysmon Event ID 3 (Network connection) to identify hosts communicating over common C2-associated ports (4000, 4001, 4002, 443) to non-private IP addresses. A risk score is calculated based on the presence of these persistence markers and outbound network connections.
This rule detects the creation of scheduled tasks that point to executable files located in suspicious directories such as ProgramData, Temp, or AppData. This behavior is indicative of persistence mechanisms commonly employed by the The Gentlemen Ransomware-as-a-Service (RaaS) group to maintain access and execute malicious components like backdoors or ransomware binaries.
Detects the creation of a Windows scheduled task via 'schtasks.exe' that specifically involves the 'MasterPackager.Updater' and execution of a 'script.vbs' file. This behavior is indicative of potential software deployment or persistence mechanisms utilizing VBScript within a scheduled task.
Form-grabbing and credential stealing malware-as-a-service
Ransomware group exploiting edge devices and managed file transfer software
Ransomware group exploiting edge devices and managed file transfer software
Detects potential malicious persistence mechanisms (scheduled tasks, WMI event subscriptions, or Registry Run keys) initiated by Python executables or PyInstaller-bundled processes. This behavior is associated with information stealers that use these methods to maintain presence on a compromised host.
Detects post-exploitation activities related to the CVE-2026-45257 BUMSRAKETE vulnerability on FreeBSD. The rule monitors for kernel module loading using kldload from suspicious directories, kldstat execution, unauthorized root-level crontab modifications, and suspicious root-level shell execution spawned from non-standard parent processes, all of which indicate potential persistence or rootkit installation following a local privilege escalation.
This rule detects the creation of scheduled tasks using either schtasks.exe or PowerShell (Register-ScheduledTask) that exhibit high-risk indicators. These indicators include executing files from suspicious locations (AppData, Temp, or specific user-writable directories), the use of encoded PowerShell commands, or initiation by common remote access tools (sshd, ssh, or mstsc). This behavior is often associated with persistence mechanisms used by adversaries.
Detects evidence of Linux-based cryptomining malware, such as xmrig and associated droppers, along with their persistence mechanisms and efforts to disable system security controls (e.g., SELinux, AppArmor, ufw). The rule monitors process execution, file creation, cron job configuration, and modifications to system immutability locks via chattr.
This rule detects the creation or registration of scheduled tasks that involve the 'PerfWatson2.exe' utility or execution paths originating from within the local AppData directory. These patterns are often associated with persistence mechanisms used by malware or malicious scripts to maintain execution after reboots.
This rule detects persistence mechanisms and fileless execution patterns commonly associated with the MYRA malware family on Linux systems. It specifically monitors for malicious cron job creation, LD_PRELOAD library manipulation, unauthorized shell profile modifications, and memfd-based execution spawned from Node.js or npm processes.
Detects the creation of a scheduled task where the action references an executable file located in common user-writable directories (ProgramData, AppData, Users\Public, or Temp) shortly after that file was created on the disk. This pattern is characteristic of persistence mechanisms used by threat actors associated with Operation Turb00, such as the Wingo or HijackLoader malware families, which use scheduled tasks to maintain persistence via dropped binaries.
Detects the Operation Turb00 SnappyClient delivery and persistence mechanism, characterized by the execution of a malicious AlphVector.exe process that loads a trojanized opera_elf.dll and WebView2Loader.dll. The rule also identifies the creation of specific persistence artifacts, including a legacy Task Scheduler 1.0 .job file named 'socket_dispatcher_v2.job' in the Windows Tasks directory and a malicious shortcut 'prompt_analyzer_debug.lnk' within the user Startup folder.
Detects the creation of a scheduled task named 'OneDriveHealth', which is associated with APT28 activity. This task is used for persistence via COM hijacking; it executes 60 seconds after registration, kills and restarts explorer.exe to facilitate the loading of a hijacked COM object, and subsequently removes itself.
Detects the creation of a Windows scheduled task that attempts to execute a VMware-related binary (vmwared.exe) under the guise of 'MicrosoftEdgeUpdate' on system logon with the highest privileges. This behavior is indicative of a persistence mechanism attempt.
This rule detects various Linux persistence mechanisms, including the use of LD_PRELOAD to hijack dynamic linker execution, the creation or modification of malicious cron jobs, and tampering with shell startup scripts. These techniques allow an adversary to maintain access to a compromised host by ensuring malicious code is executed automatically or injected into legitimate processes.
Detects the creation of scheduled tasks using schtasks.exe or at.exe where the command line contains suspicious indicators such as execution from AppData/Temp directories, use of LOLBins (rundll32, regsvr32, powershell), encoded commands, or suspicious command-line patterns, specifically when the initiating process is not signed by Microsoft.
Page 25 of 51