Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,053 detections
Filters
Last updated
All Time
Detection languages
502
165
78
75
69
Contributors
326
184
158
51
46
Categories
20,456
11,839
5,876
5,155
4,865
1,053
Platforms
929
119
24
11
4
Products / Services
408
279
229
194
114
MITRE Techniques
1,019
1,002
879
616
183
CVEs
2
1
1
1
1
IDS Classtypes
5
4
2
1
IDS Protocols
8
4
Commodity .NET keylogger and remote access trojan
macOS malware used by JINX-0164 against cryptocurrency developers
Commodity .NET keylogger and remote access trojan
This rule detects the creation of a scheduled task using 'schtasks.exe' that involves suspicious filenames or paths, specifically focusing on components associated with QEMU, database files, or known suspicious executables. It further highlights tasks created with high-privilege context (SYSTEM or highest integrity level) or those configured to trigger on system-level events (logon, start, idle), which are common indicators of persistence mechanisms used by attackers.
Detects the creation of scheduled tasks using schtasks.exe that point to high-risk directories (Temp, AppData, ProgramData) or utilize obfuscated PowerShell commands (encoded parameters). This behavior is often associated with adversary persistence or initial execution.
Detects scheduled tasks created with embedded PowerShell XOR decoding logic, ReadAllBytes, and Invoke-Expression techniques that may be used to establish persistence and execute obfuscated payloads. The rule specifically looks for 'schtasks.exe' creating a task with '/create', containing 'OneDrive', 'Startup', 'Task' in the command line, and also includes '-bxor', 'ReadAllBytes', 'iex', and '[Text.Encoding]::UTF8.GetBytes' which are indicative of obfuscated PowerShell execution via XOR decoding.
Detects execution of 'schtasks.exe' spawned by 'ConfigurationRemotingServer.exe'. This pattern is often associated with remote management or administrative tasks, but can be leveraged by adversaries to establish persistence or remote execution.
Detects instances where ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe are observed spawning schtasks.exe, powershell.exe, or pwsh.exe with command line arguments indicative of creating or registering a scheduled task. This behavior is highly irregular for these system binaries and may indicate an adversary attempting to achieve persistence by masquerading or exploiting legitimate Windows management components.
Detects persistence establishment via the Windows Package Manager (WinGet) Desired State Configuration (DSC) engine. The rule identifies instances where 'ConfigurationRemotingServer.exe' or 'WindowsPackageManagerServer.exe' spawns 'schtasks.exe' or uses PowerShell to create scheduled tasks. It correlates process execution events with Security Event ID 4698 to identify unauthorized scheduled task creation within the WinGet DSC context.
Detects instances where the ConfigurationRemotingServer.exe process spawns tools like schtasks.exe, powershell.exe, or pwsh.exe to create a scheduled task. This behavior is indicative of an attacker abusing the WinGet configuration management (DSC) engine, specifically via the 'winget configure' mechanism, to establish persistence by triggering the creation of a new scheduled task through a DSC script resource.
Detects the execution of 'schtasks.exe' spawned by 'ConfigurationRemotingServer.exe'. This pattern is indicative of persistent scheduled task creation being orchestrated through the abuse of WinGet Desired State Configuration (DSC) resource management capabilities.
Detects the Amadey loader malware attempting to establish persistence via Windows Scheduled Tasks. The rule monitors for the execution of schtasks.exe with parameters creating a task that points to suspicious user-writable directories (Temp, AppData) or known Amadey-related artifacts such as the 'e079729711' staging path or 'nudwee.exe' binary.
Detects execution of schtasks.exe initiated by common scripting languages (wscript, cscript, powershell, pwsh) or execution involving files within the ProgramData directory, which are frequent indicators of malicious activity related to persistence or automated task manipulation.
Detects indicators of persistence activity associated with the MYRA RAT. This includes unauthorized modifications to shared library preload mechanisms (/etc/ld.so.preload), creation of malicious shared objects in systemd user paths by common interpreter/shell processes, suspicious modification of cron job files by those same processes, and the execution of the 'systemd-userdbd' process from non-standard, unauthorized filesystem locations.
This rule detects the creation or configuration of a scheduled task named 'GoogleErrorReport' which references 'Fondue.exe' located in the 'C:\Users\Public' directory. This specific pattern is associated with 'Dropping Elephant' malware persistence, where the task ensures the binary executes persistently on the host.
Detects the installation of the Kazuar backdoor, indicated by the creation of a scheduled task or service, following initial access via stolen credentials. This detection correlates suspicious persistence mechanisms with a remote session login on a host previously identified with StealC activity, suggesting a multi-stage attack where initial compromise (StealC) leads to credential theft, followed by remote access and persistence (Kazuar).
This rule detects the creation or registration of scheduled tasks that involve the 'PerfWatson2.exe' utility or execution paths originating from within the local AppData directory. These patterns are often associated with persistence mechanisms used by malware or malicious scripts to maintain execution after reboots.
Detects the creation of specific scheduled tasks associated with LoaderClient or WeedHack malware. These tasks, named 'JMonitoringTask' or 'JavaSecurityUpdater', are used for persistence and recurring execution of malicious code.
Detects the creation of scheduled tasks using schtasks.exe that run at logon with highest privileges, specifically targeting known update or system binaries which may indicate malicious persistence or masquerading techniques.
This rule detects the creation or configuration of a scheduled task named 'GoogleErrorReport' which references 'Fondue.exe' located in the 'C:\Users\Public' directory. This specific pattern is associated with 'Dropping Elephant' malware persistence, where the task ensures the binary executes persistently on the host.
Detects persistence mechanisms associated with the MYRA Linux RAT, including LD_PRELOAD hijacking for shared library redirection, malicious cron job creation with specific scheduling (13-minute intervals), and unauthorized modifications to profile.d scripts to execute malicious code.
Page 34 of 51