Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,053 detections
Filters
Last updated
All Time
Detection languages
502
165
78
75
69
Contributors
326
184
158
51
46
Categories
20,456
11,839
5,876
5,155
4,865
1,053
Platforms
929
119
24
11
4
Products / Services
408
279
229
194
114
MITRE Techniques
1,019
1,002
879
616
183
CVEs
2
1
1
1
1
IDS Classtypes
5
4
2
1
IDS Protocols
8
4
Detects the creation of scheduled tasks using the 'schtasks.exe' utility with either system-level privileges ('/ru SYSTEM') or persistent triggers ('/sc onlogon' or '/sc onstart'). The rule filters out commonly trusted parent processes, highlighting potential persistence mechanisms established by unauthorized or unusual processes.
Detects the creation of scheduled tasks (via Event ID 4698 or schtasks.exe) involving suspicious action paths, encoded PowerShell commands, LOLBins, or tasks configured to run as SYSTEM by non-administrator users, which is a common persistence mechanism for malware.
Detects the creation of scheduled tasks using Event ID 4698 or command-line execution of schtasks.exe. The rule specifically looks for tasks created in suspicious paths such as AppData or ProgramData, or tasks configured to run with highest privileges and/or marked as hidden, which are common indicators of persistence mechanisms used by adversaries.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility where the task is configured to run in the security context of the SYSTEM account or executes suspicious binaries like PowerShell, mshta, or other living-off-the-land binaries. This behavior is indicative of potential persistence mechanisms employed by adversaries.
Detects Microsoft Office applications or scripting engines spawning schtasks.exe to create or modify a scheduled task that executes as the SYSTEM user upon system startup or login. This behavior is highly indicative of persistence mechanisms used by malicious documents or scripts.
This rule detects persistence establishment via Scheduled Task creation shortly (within 15 minutes) after a suspicious PowerShell process execution. The PowerShell execution matches the 'ClickFix' pattern, characterized by hidden/bypass window styles and the invocation of remote download or execution cmdlets (e.g., IEX, IRM).
Detects the creation of scheduled tasks using schtasks.exe that involve suspicious arguments (such as encoded commands, execution from volatile directories like Temp/AppData, or run-once triggers) shortly after a file has been downloaded into a temporary or user-writable directory. This pattern is commonly indicative of an adversary establishing persistence for downloaded malware.
Detects the creation of scheduled tasks using schtasks.exe that execute common script interpreters (powershell.exe, wscript.exe, mshta.exe, cscript.exe) from user-writable or temporary directories (Temp, AppData, ProgramData, Users\Public). This activity often indicates an attempt to establish persistence or run malicious scripts.
Detects the creation of a scheduled task using 'schtasks.exe' that involves suspicious command-line patterns, specifically tasks pointing to potentially volatile directories (temp, appdata, programdata) or tasks executing PowerShell/CMD with common obfuscation/execution arguments such as encoded commands, hidden window styles, or base64 decoding.
Detects the creation of scheduled tasks, recurring jobs, or webhook subscriptions by a user identity flagged as an AI_AGENT. This activity is monitored for persistence, especially when the event lacks a descriptive context or targets external networks, suggesting potential unauthorized agent behavioral drift or malicious persistence.
The rule detects correlation between the creation of persistence-related Registry keys (specifically Windows Run keys or Browser Native Messaging hosts) and the execution of the schtasks.exe utility to create or manage a task related to 'psychedelicloveUtils'. This pattern suggests an adversary attempting to maintain persistence by linking Registry-based autostart mechanisms with a scheduled task.
The rule detects correlation between the creation of persistence-related Registry keys (specifically Windows Run keys or Browser Native Messaging hosts) and the execution of the schtasks.exe utility to create or manage a task related to 'psychedelicloveUtils'. This pattern suggests an adversary attempting to maintain persistence by linking Registry-based autostart mechanisms with a scheduled task.
The rule detects correlation between the creation of persistence-related Registry keys (specifically Windows Run keys or Browser Native Messaging hosts) and the execution of the schtasks.exe utility to create or manage a task related to 'psychedelicloveUtils'. This pattern suggests an adversary attempting to maintain persistence by linking Registry-based autostart mechanisms with a scheduled task.
Detects persistence attempts using common Windows auto-start registry keys or scheduled tasks where the initiating process is unsigned or has an invalid signature. The rule focuses on binaries executing from suspicious, user-writable directories (e.g., Temp, AppData, Downloads) and specifically targets persistence mechanisms involving the 'SecurityHealthService.exe' filename.
Detects persistence attempts using common Windows auto-start registry keys or scheduled tasks where the initiating process is unsigned or has an invalid signature. The rule focuses on binaries executing from suspicious, user-writable directories (e.g., Temp, AppData, Downloads) and specifically targets persistence mechanisms involving the 'SecurityHealthService.exe' filename.
Detects persistence attempts using common Windows auto-start registry keys or scheduled tasks where the initiating process is unsigned or has an invalid signature. The rule focuses on binaries executing from suspicious, user-writable directories (e.g., Temp, AppData, Downloads) and specifically targets persistence mechanisms involving the 'SecurityHealthService.exe' filename.
Detects the creation of a Windows scheduled task via schtasks.exe where the initiating process is located in common user-writable temporary or non-standard directories (e.g., AppData, Temp, or Public folders). This behavior is often indicative of malicious persistence mechanisms being established by a dropper or stage-one malware payload.
Detects the creation of a Windows scheduled task via schtasks.exe where the initiating process is located in common user-writable temporary or non-standard directories (e.g., AppData, Temp, or Public folders). This behavior is often indicative of malicious persistence mechanisms being established by a dropper or stage-one malware payload.
Detects a behavioral chain where a process establishes persistence using a 'WindowsUpdate' Registry Run key or a scheduled task, followed within five minutes by an outbound network connection from the same process. The rule specifically excludes cases where a ZIP file was written to disk, identifying potential in-memory staging for exfiltration.
This rule detects potentially malicious activities involving the creation of suspicious scheduled tasks or the use of system binaries (rundll32.exe and control.exe) to execute commands, often associated with lateral movement or persistence. It looks for schtasks.exe commands creating tasks with specific deceptive names, and rundll32.exe or control.exe executing from remote network paths or suspicious command line arguments.
This rule detects potentially malicious activities involving the creation of suspicious scheduled tasks or the use of system binaries (rundll32.exe and control.exe) to execute commands, often associated with lateral movement or persistence. It looks for schtasks.exe commands creating tasks with specific deceptive names, and rundll32.exe or control.exe executing from remote network paths or suspicious command line arguments.
Page 5 of 51