Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,053 detections
Filters
Last updated
All Time
Detection languages
502
165
78
75
69
Contributors
326
184
158
51
46
Categories
20,456
11,839
5,876
5,155
4,865
1,053
Platforms
929
119
24
11
4
Products / Services
408
279
229
194
114
MITRE Techniques
1,019
1,002
879
616
183
CVEs
2
1
1
1
1
IDS Classtypes
5
4
2
1
IDS Protocols
8
4
Udm Task Fonts Startup
YARA-L
Targets the startup task behaviour that launches a Fonts-hosted executable with SYSTEM-level persistence. The UDM rule retains principal and target context for correlation.
Correlates the MiniJunk V2 persistence task with the execution of the renamed SoftwareLicencing.exe. This rule detects the creation of a scheduled task named "Synchronize OS" via schtasks.exe, and then correlates it with the execution of a file named "SoftwareLicencing.exe" on the same device. This behavior is indicative of the MiniJunk V2 malware used by the Screening Serpens APT group.
Identifies the creation or execution of a 'VirtualSmokestGuy' scheduled task, which is associated with CastleRAT for persistence. The rule specifically looks for command-line activity containing 'VirtualSmokestGuy' and excludes specific numerical strings to reduce false positives.
Identifies schtasks.exe creating persistence mechanisms configured with both logon and startup triggers simultaneously, a signature of the CheckRealtekAudioVersion task.
Detects schtasks.exe establishing persistence using task names that spoof legitimate Windows services (e.g., Synchronize OS, Windows System Health, BackupCheck, WindowsSecurityUpdate).
Detects cron job creation for Linux persistence or execution
This rule detects potential lateral movement activities post-compromise by monitoring process creation events (EventID 4688, 4689) for common administrative tools like PsExec, WMIC, and commands related to scheduled tasks. It specifically looks for these tools being used to execute commands on multiple target computers from a single initiating account within a short timeframe (2 hours), indicating an adversary attempting to move across the network.
Detects the creation of specific systemd service files, macOS LaunchAgents, or payload files ('update.py') used by the Miasma toolkit for its GitHub polling backdoor. This rule identifies file creation or modification events indicative of the Miasma toolkit establishing persistence on Linux and macOS systems.
Detects the creation and subsequent deletion of a scheduled task within a short timeframe (5 minutes), which can indicate an attacker attempting to cover their tracks after executing a malicious task.
Detects the creation of scheduled tasks using `schtasks.exe` that include encoded PowerShell commands or base64 strings in their actions. This rule specifically looks for the use of `-EncodedCommand`, `-enc`, `-e`, `powershell`, `FromBase64String`, `IEX`, `Invoke-Expression`, and paths like `AppData`, `Temp`, or `ProgramData` within the command line, which are indicators of the PRISMEX implant used by APT28 for persistence.
Detects the creation of specific scheduled tasks known to be used by ScarCruft (APT37) to establish persistence for NarwhalRAT. The rule looks for scheduled task creation events (EventID 4698 in SecurityEvent logs or ActionType 'ScheduledTaskCreated' in DeviceEvents) where the task name matches known malicious task names used by ScarCruft, specifically 'MicrosoftUserInterfacePicturesUpdateTackMachine' and 'MicrosoftMusicLibrariesPackageTaskMachine'.
Detects if the backdoor file 'install-persistent.php' is scheduled for persistence via cron or Windows scheduled tasks. This indicates a potential supply chain compromise targeting ShapedPlugin.
This rule detects the creation or modification of a Windows scheduled task that includes 'deno' in its command line. This activity is suspicious as it can indicate malware establishing persistence on a system, especially on typical office PCs where Deno is not commonly used. Further investigation is recommended to determine if the activity is legitimate or malicious.
Detects the creation of a scheduled task used by NarwhalRAT for persistence, using a specific task name and execution pattern. The rule looks for 'schtasks.exe' being executed with '/create' or '-create' flags and the unique task name 'MicrosoftUserInterfacePicturesUpdateTackMachine'. It covers process creation events from DeviceProcessEvents, SecurityEvent (EventID 4688), and Sysmon (EventID 1).
Detects the creation of a scheduled task named 'SoftwareProtection' that executes a Python payload, indicative of ModeloRAT persistence.
Detects the creation of a scheduled task named 'AlphaSecurity' using schtasks.exe with the '/create' command-line argument. This specific task name and creation method have been associated with the Broomstick backdoor, which is used by the Rhysida ransomware group for persistence.
This rule detects potential lateral movement activities post-compromise by monitoring process creation events (EventID 4688, 4689) for common administrative tools like PsExec, WMIC, and commands related to scheduled tasks. It specifically looks for these tools being used to execute commands on multiple target computers from a single initiating account within a short timeframe (2 hours), indicating an adversary attempting to move across the network.
This rule detects the creation of scheduled tasks (Event ID 4698) that are configured to execute scripting languages (PowerShell, cmd, Python, Java) with hidden window styles. This behavior is often indicative of an adversary attempting to establish persistence while evading detection by hiding the execution of their malicious scripts.
Detects systemd timer unit file creation for Linux scheduled task persistence
Detects the creation of a scheduled task named 'XenoUpdateManager' using 'schtasks.exe', which is associated with the Operation XENOFISCAL campaign and the SideCopy threat group. The rule also surfaces the parent process that initiated the scheduled task creation.
Detects the creation of the WindowsVaultSyncService scheduled task or a task using the specific misleading description observed in SHEETCREEP (APT36) infections. The malware uses the Task Scheduler COM API to establish persistence.
Page 39 of 51