Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,053 detections
Filters
Last updated
All Time
Detection languages
502
165
78
75
69
Contributors
326
184
158
51
46
Categories
20,456
11,839
5,876
5,155
4,865
1,053
Platforms
929
119
24
11
4
Products / Services
408
279
229
194
114
MITRE Techniques
1,019
1,002
879
616
183
CVEs
2
1
1
1
1
IDS Classtypes
5
4
2
1
IDS Protocols
8
4
This rule detects potential persistence via scheduled tasks that masquerade as legitimate network components (e.g., 'System Health Monitor'), as well as abnormal use of WebDav via rundll32.exe or net.exe in the context of the Star Blizzard (COLDRIVER) campaign. It monitors for task creation/updates, schtasks command lines, registry artifacts related to task scheduling, and suspicious WebDav network utility usage, while excluding common security tool processes.
Detects signs of the ClosedQuorum implant by correlating at least two redundant persistence mechanisms (Registry Run keys, Scheduled Tasks, WMI execution) on the same host within a 10-minute window. The rule focuses on artifacts originating from suspicious user-writable paths or unsigned binaries, while excluding known legitimate installation paths.
Detects the creation of scheduled tasks using 'schtasks.exe' or 'Register-ScheduledTask' where the task command path is located in suspicious directories such as AppData, Temp, or ProgramData, or where the task is configured to run under the SYSTEM account. This behavior is commonly used by adversaries for persistence.
Detects the creation of a Windows scheduled task where the task name contains the string 'keyroll', often associated with credential rotation or suspicious persistence mechanisms.
This rule monitors for suspicious persistence mechanisms associated with 'Agta Backup' software, specifically looking for the creation of new Windows services, the addition of scheduled tasks, and the manipulation of processes related to 'Credential Guard.exe' within Agta Backup directories. It also tracks the presence of specific file artifacts within the application's install directories, which could indicate unauthorized installation or persistence attempts.
Detects the creation of a scheduled task intended to masquerade as 'MicrosoftEdgeUpdateTask' using either schtasks.exe or PowerShell. The rule specifically monitors for tasks being registered in AppData/Roaming directories, which is a common indicator of persistence by malicious actors attempting to mimic legitimate Microsoft Edge update processes.
Detects the creation of a scheduled task intended to masquerade as 'MicrosoftEdgeUpdateTask' using either schtasks.exe or PowerShell. The rule specifically monitors for tasks being registered in AppData/Roaming directories, which is a common indicator of persistence by malicious actors attempting to mimic legitimate Microsoft Edge update processes.
Detects evidence of persistence mechanisms associated with the CARBONATO botnet on Linux systems. This includes the application of chattr +i to the malicious watchdog binary, the execution of the auto-persist-host.sh script, the enabling of the docker-network-resolver systemd timer, or modifications to crontab for watchdog execution.
Detects persistence mechanisms used by the CARBONATO botnet on Linux-based Docker hosts. The rule monitors for the application of immutable file attributes using 'chattr +i' on identified watchdog binaries (specifically '.docker-network-monitor'), the creation of malicious cron jobs, the enabling of suspicious systemd timers ('docker-network-resolver'), and the execution of specific persistence-related shell scripts.
Detects MayaBot's scheduled-task persistence chain by correlating two signals on the same device within a 60-minute window: (1) schtasks.exe creating a daily task referencing a hidden batch script (update.bat/backup.bat/firewall-update.bat) under AppData\Local, spawned from wscript.exe/cscript.exe/cmd.exe, and (2) cmd.exe launching a hidden-window PowerShell process referencing the same batch scripts under AppData\Local. Requiring both signals together, anchored to the AppData\Local path, sharply reduces false positives compared to alerting on either behavior alone.
The rule detects correlation between the creation of persistence-related Registry keys (specifically Windows Run keys or Browser Native Messaging hosts) and the execution of the schtasks.exe utility to create or manage a task related to 'psychedelicloveUtils'. This pattern suggests an adversary attempting to maintain persistence by linking Registry-based autostart mechanisms with a scheduled task.
Detects the creation of scheduled tasks using schtasks.exe or PowerShell where the task binary path resides in suspicious directories frequently used by adversaries for staging, such as AppData, Temp, Downloads, or Public folders.
Detects the creation of multiple suspicious scheduled tasks using schtasks.exe initiated by scripting engines (wscript.exe, cscript.exe). The rule filters for specific task names associated with known malicious patterns and XML definition files located in a specific directory path, identifying potential automated persistence or malware installation behavior.
Detects creation of the 'keyroll' scheduled task used to relaunch the Sauron Loader DLL side-loading chain. Requires the schtasks.exe command line to both reference the 'keyroll' task name AND explicitly reference the ProgramData\keyroll path or rnpkeys.exe (ruling out unrelated tasks that happen to be named 'keyroll', e.g. legitimate key-rotation automation), and requires an INNER join corroborating an actual rnpkeys.exe relaunch from that path within 24h — a lone task-creation event with no follow-on relaunch no longer alerts.
Detects various persistence mechanisms used by the CARBONATO botnet on Linux systems, including registration of cron jobs, systemd services/timers, and the usage of 'chattr +i' to make persistence files immutable.
Detects a multi-stage installation of the Level RMM agent. This rule monitors for a correlation of events including the execution of 'LevelInstaller.exe' with specific installation arguments, file drops in potentially spoofed vendor paths (Dell or Level), the creation of a 'Level' service, and the addition of a 'Level Watchdog' scheduled task on the same device within a 24-hour window.
Detects signs of the ClosedQuorum implant by correlating at least two redundant persistence mechanisms (Registry Run keys, Scheduled Tasks, WMI execution) on the same host within a 10-minute window. The rule focuses on artifacts originating from suspicious user-writable paths or unsigned binaries, while excluding known legitimate installation paths.
This rule monitors for coordinated persistence efforts by detecting the occurrence of at least two out of three specific persistence techniques (registry run key modification, scheduled task creation, or WMI-based script execution) on the same device within a 30-minute window. It explicitly filters out activities from signed binaries or those occurring in standard system/application directories, focusing on potentially malicious artifacts originating from user-writable locations.
Detects the creation of a scheduled task named 'keyroll' in close temporal proximity to the execution of 'rnpkeys.exe' from 'C:\ProgramData\keyroll'. This pattern mimics the persistence mechanism used by the Sauron malware (a.k.a. Strider) to execute its loader chain.
Detects the creation of a scheduled task named 'keyroll' using either schtasks.exe command line arguments or Windows Event ID 4698. This specific task name is associated with the persistence mechanism of the Sauron Loader, particularly when it references 'rnpkeys.exe' or 'ProgramData\keyroll'.
Detects the creation of a scheduled task named 'keyroll' using either schtasks.exe command line arguments or Windows Event ID 4698. This specific task name is associated with the persistence mechanism of the Sauron Loader, particularly when it references 'rnpkeys.exe' or 'ProgramData\keyroll'.
Page 6 of 51