Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,053 detections
Filters
Last updated
All Time
Detection languages
502
165
78
75
69
Contributors
326
184
158
51
46
Categories
20,456
11,839
5,876
5,155
4,865
1,053
Platforms
929
119
24
11
4
Products / Services
408
279
229
194
114
MITRE Techniques
1,019
1,002
879
616
183
CVEs
2
1
1
1
1
IDS Classtypes
5
4
2
1
IDS Protocols
8
4
Detects the creation of scheduled tasks using the schtasks utility that masquerade as legitimate update services (MicrosoftEdgeUpdate or GoogleUpdaterTaskSystem). These tasks are configured to run at logon with highest privileges, specifically aiming to persist the TinyRCT backdoor (associated with files such as vmwared.exe or vmtools.exe) in ProgramData directories.
Detects the creation of a 'MasterPackager.Updater' scheduled task by a suspicious instance of RegAsm.exe (hollowed process). The task is configured to execute a VBScript located in C:\Users\Public every two minutes, a known tactic associated with AsyncRAT delivery chains.
Detects cron-based watchdog persistence installed by lambsys.elf as part of the CVE-2026-33017 Langflow cryptominer campaign. The malware writes a per-user crontab via crontab stdin firing every 5 minutes, checking for lambsys via pgrep and re-downloading from C2 if absent, logging to /var/tmp/check_process.log.
This rule detects a multi-stage loader chain behavior. Stage 1 identifies PowerShell spawning mshta.exe or wscript.exe, which is commonly used to execute malicious scripts or loaders. Stage 2 detects mshta.exe or wscript.exe subsequently executing schtasks.exe or wmic.exe with command-line arguments indicative of establishing persistence via scheduled tasks or WMI event subscriptions.
Detects the creation of scheduled tasks using schtasks.exe where the task action executes a scripting engine or living-off-the-land binary (LOLBin). This behavior is often indicative of adversaries attempting to establish persistence or execute code using native system tools to evade detection.
Detects the creation of specific scheduled tasks associated with LoaderClient or WeedHack malware. These tasks, named 'JMonitoringTask' or 'JavaSecurityUpdater', are used for persistence and recurring execution of malicious code.
Detects the creation of specific scheduled tasks associated with LoaderClient or WeedHack malware. These tasks, named 'JMonitoringTask' or 'JavaSecurityUpdater', are used for persistence and recurring execution of malicious code.
Detects the creation of scheduled tasks at 1-minute intervals using 'schtasks.exe' that employ masqueraded names (e.g., MicrosoftUserInterface) or execute known suspicious payloads associated with the NarwhalRAT malware (e.g., python scripts or .cat files). This behavior is characteristic of persistence mechanisms used by APT37.
Detects the creation of scheduled tasks using schtasks.exe or at.exe by processes not signed by Microsoft. This behavior is often associated with adversary attempts to establish persistence by running code on a recurring basis or at specific times using native Windows utilities.
Detects the creation of scheduled tasks using schtasks.exe or at.exe by processes not signed by Microsoft. This behavior is often associated with adversary attempts to establish persistence by running code on a recurring basis or at specific times using native Windows utilities.
Detects the creation or modification of scheduled tasks using the schtasks.exe utility initiated by a process not signed by Microsoft. This behavior is often associated with adversary attempts to establish persistence or automate malicious code execution.
Detects the creation or modification of scheduled tasks using the schtasks.exe utility initiated by a process not signed by Microsoft. This behavior is often associated with adversary attempts to establish persistence or automate malicious code execution.
Detects the creation of a scheduled task named 'OneDriveHealth', which is associated with APT28 activity. This task is used for persistence via COM hijacking; it executes 60 seconds after registration, kills and restarts explorer.exe to facilitate the loading of a hijacked COM object, and subsequently removes itself.
This rule detects potentially malicious lateral movement or persistence activities by monitoring the creation or modification of executable files in remote network shares and startup folders, as well as the use of administrative tools like sc.exe or schtasks.exe to create services or tasks. The rule specifically filters out processes signed by Microsoft, focusing on non-standard or unsigned binaries that perform these administrative actions across multiple instances, indicating potential automated lateral propagation.
Detects the creation of a new scheduled task using the Windows native schtasks.exe command-line utility. This behavior is commonly associated with persistence mechanisms or lateral movement activities where attackers schedule tasks to execute malicious payloads.
Detects the creation of a new scheduled task using the Windows native schtasks.exe command-line utility. This behavior is commonly associated with persistence mechanisms or lateral movement activities where attackers schedule tasks to execute malicious payloads.
Detects the creation or modification of a scheduled task named 'OneDrive Update', which is known to be used by the BLUERABBIT backdoor for persistence. The rule looks for Windows Security Events (EventID 4698 for task creation, 4702 for task modification) and process execution events where command lines indicate scheduled task registration via tools like 'schtasks', 'Register-ScheduledTask', or 'New-ScheduledTask' with the specific task name 'OneDrive Update'.
Detects when a non-root user modifies, creates, or renames files within common cron directories or the main crontab file on Linux systems. This activity can indicate an attempt to establish persistence or schedule malicious tasks.
Detects the creation of plist files within macOS /Library/LaunchAgents/ or /Library/LaunchDaemons/ directories by the osascript utility. This behavior is indicative of Meow RAT establishing persistence by masquerading as a legitimate system service.
Detects potential persistence attempts via cron job manipulation by unprivileged service accounts (such as www-data) or patterns indicative of the 'lambsys' threat, including usage of known writable temporary directories, non-interactive crontab installations, and aggressive execution schedules.
Detects adversary activity associated with CL-STA-1062, specifically the use of archive extraction tools to unpack content into hidden or masqueraded ProgramData directories (VMware, Microsoft, Intel). The rule also monitors for process execution and the creation of scheduled tasks that utilize these specific staging paths.
Page 28 of 51