Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,053 detections
Filters
Last updated
All Time
Detection languages
502
165
78
75
69
Contributors
326
184
158
51
46
Categories
20,456
11,839
5,876
5,155
4,865
1,053
Platforms
929
119
24
11
4
Products / Services
408
279
229
194
114
MITRE Techniques
1,019
1,002
879
616
183
CVEs
2
1
1
1
1
IDS Classtypes
5
4
2
1
IDS Protocols
8
4
Detects indicators associated with the MiniUpdate RAT deployed by the threat group Screening Serpens. This rule identifies network connections to known C2 domains, the creation of a persistence scheduled task named 'WindowsSecurityUpdate', and the dropping of specific RAT module DLLs ('UpdateChecker.dll', 'InitInstall.dll', 'Updater.dll') in common user-writable directories. The file event detection is tuned to require multiple generic DLLs or the presence of 'InitInstall.dll' to reduce false positives.
Remote AT Scheduled Job Creation
Suricata
This rule detects attempts to create scheduled jobs remotely using the 'atsvc' service, typically associated with the Windows Task Scheduler. It specifically looks for TCP traffic on port 445 (SMB) containing the string 'atsvc' in an established flow to the home network. This activity can be indicative of an adversary establishing persistence or executing code remotely.
This rule detects the creation of remote scheduled tasks over SMB by looking for the string "schtasks" in TCP traffic destined for port 445 (SMB). This activity is often associated with persistence techniques where attackers establish scheduled tasks on remote systems.
Detects the creation of scheduled tasks originating from processes executing out of temporary or download directories. This behavior aligns with the persistence mechanisms of the SilverGorilla .NET dropper, which is typically delivered via recruitment-themed phishing archives.
Detects the creation of a scheduled task named '\MicrosoftSystem64', which is a specific Indicator of Compromise (IoC) associated with the Windows variant of the FAMOUS CHOLLIMA / MicrosoftSystem64 RAT malware for persistence. The rule identifies this activity through Windows Event Log (Event ID 4698 for task creation), command-line execution of 'schtasks.exe' with '/create' and the specific task name, and Defender EDR telemetry for scheduled task creation.
Detects suspicious scheduled task creation using schtasks.exe with XML task imports from user-writable directories such as AppData\Local. This behavior is associated with malware families like JustAskJacky, which establish persistence by creating GUID-named scheduled tasks that execute malicious payloads such as node.exe and obfuscated JavaScript files.
Detects the creation of a scheduled task named 'SystemUpdate' using 'schtasks.exe', which is a persistence mechanism observed in the Phantom Bot malware distributed via malicious npm packages. The rule specifically looks for the 'create' action and the 'SystemUpdate' task name in the command line.
This rule detects various suspicious activities associated with a cryptojacking campaign, including the execution of 'RuntimeHost.exe' from unusual directories, creation of suspicious scheduled tasks, DLL side-loading followed by silent MSI execution, process hollowing into .NET utilities, Windows Defender exclusion attempts, and persistence mechanisms via startup folder shortcuts and registry run keys. These activities are indicative of an attacker establishing persistence and evading defenses to perform unauthorized cryptocurrency mining.
Detects scheduled tasks created with embedded PowerShell XOR decoding logic, ReadAllBytes, and Invoke-Expression techniques that may be used to establish persistence and execute obfuscated payloads. The rule specifically looks for 'schtasks.exe' creating a task with '/create', containing 'OneDrive', 'Startup', 'Task' in the command line, and also includes '-bxor', 'ReadAllBytes', 'iex', and '[Text.Encoding]::UTF8.GetBytes' which are indicative of obfuscated PowerShell execution via XOR decoding.
This rule detects various activities associated with the Nimbus Manticore implant, including its process execution with a specific argument, the creation of a scheduled task for persistence, and the staging of malicious files in a specific AppData directory. It looks for the execution of 'setup.exe' with 'doit' argument, the creation of a scheduled task containing 'BackupCheck', and the creation of specific files like 'setup.exe.config', 'TOTPGuard.dll', 'main.dll', and 'setup.exe' within the '\AppData\Roaming\2FAGuard\' folder.
Detects the creation of scheduled tasks using an XML file located in a temporary directory, a technique used by DesckVB for stealthy persistence.
This rule detects the creation of a scheduled task named 'MicrosoftSystem64' using various methods. It looks for command-line execution of 'schtasks.exe /create' with the specific task name, explicit ScheduledTaskCreated events from Microsoft Defender for Endpoint (MDE) containing 'MicrosoftSystem64', and Windows Security Event ID 4698 (Scheduled Task Created) where the TaskName contains 'MicrosoftSystem64'. This specific task name is associated with known threat actor activity, particularly FAMOUS CHOLLIMA / DPRK-linked actors deploying Node.js SEA RAT.
Identifies the creation, execution, or deletion of specific scheduled tasks ('\Mozilla\ElevateTask' or '\Mozilla\UpdateTask') used by Payouts King ransomware for persistence and SYSTEM elevation.
Detects the creation of a scheduled task named 'Microsoft Display Manager' using schtasks.exe. This specific task name is associated with the BoldTealLayer malware loader, which uses this persistence mechanism when running with administrative privileges.
Detects creation of scheduled tasks followed by execution of pcalua.exe on the same endpoint. This combination was observed by Huntress during RedCurl intrusions and is uncommon in legitimate enterprise activity.
This rule detects the creation of scheduled tasks using `schtasks.exe` or `at.exe` with specific command-line arguments (`/create`, `/tn`, and either `/ru` or `/tr`). It then correlates these process events with registry events related to Task Scheduler keys or values containing "Task" to identify potential persistence mechanisms.
This rule detects the creation of scheduled tasks (`schtasks.exe /create`) where the command line arguments contain suspicious executables or paths commonly associated with malicious activity. This indicates a potential persistence mechanism being established by an adversary.
Detects the creation of scheduled tasks that explicitly call mshta.exe, matching the persistence mechanism of the CountLoader payload launcher.
Detects the creation of a specific scheduled task (TempLogA) used by ModeloRAT to establish persistence and maintain SYSTEM-level access on compromised hosts. The rule looks for `schtasks.exe` execution with `/create`, `TempLogA`, and `SYSTEM` in the command line.
Detects the creation of scheduled tasks named 'ChromeCheck' or 'EdgeCheck' that execute regsvr32.exe. This behavior is associated with Kimsuky's MemLoad loader, which establishes persistence to deploy the httpTroy backdoor.
Detects the creation of a specific scheduled task (TempLogA) used by ModeloRAT to establish persistence and maintain SYSTEM-level access on compromised hosts. The rule looks for `schtasks.exe` execution with `/create`, `TempLogA`, and `SYSTEM` in the command line.
Page 41 of 51