Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
116 detections
Filters
Last updated
All Time
Detection languages
67
18
14
7
5
Contributors
30
27
14
12
8
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
101
20
2
2
1
Products / Services
41
26
18
15
15
MITRE Techniques
110
101
81
50
27
CVEs
5
1
1
IDS Classtypes
1
IDS Protocols
1
Detects the TWINLOOT Python implant's self-update mechanism, in which a schtasks.exe process is spawned with '/Run' by a pythonw.exe parent process while referencing a reobf.json manifest on the command line, indicating the implant is relaunching itself via a scheduled task after fetching an updated/reobfuscated payload configuration.
Detects the creation and configuration of suspicious LaunchAgent and LaunchDaemon plist files on macOS. It identifies files masquerading as legitimate system components (e.g., com.finder.helper, .mainhelper, .agent) or exhibiting common patterns of persistent agent names (random 10+ character names). It also monitors for the use of 'launchctl load' to activate these suspicious configuration files.
Detects anomalous scheduled task execution by identifying processes named 'csvchost.exe' or 'psvchost.exe' that reference GoogleUpdateService or MSEdgeUpdateService task names containing GUID patterns. It further correlates this with suspicious command-line indicators such as 'App.py' references, 'WakeToRun' flags, '-headless' flags, or PowerShell bypass techniques, which are associated with the delivery of CountLoader and DeviceManager RATs in DOUBLECUP campaigns.
Detects a pattern where a process enumerates running processes via tasklist looking for msedge.exe with SHELL32.dll or CoreUIComponents.dll modules loaded, followed within 5 minutes by a taskkill /F /PID command against that process, initiated by svchost.exe, taskeng.exe, python.exe, pythonw.exe, powershell.exe, or a process invoked via native_host.py. This behavior matches Edgecution's technique of detecting a running headless Edge instance and terminating it before relaunching, as observed in the UNC6692 campaign.
This query performs comprehensive field extraction and normalization on SentinelOne Deep Visibility raw logs. It acts as a parsing and preparation layer to structure diverse event categories (process, network, file, registry, authentication, and task events) into a standardized format for security analysis, triage, and threat hunting.
Detects the mrmustard supply-chain implant establishing persistence by writing a crontab entry that invokes the compiled stealer 'hw_probe.pyc' every 15 minutes, or direct crontab command invocation referencing the file.
Detects the abuse of the Windows Error Reporting (WER) service mechanism, specifically targeting the 'QueueReporting' scheduled task. Attackers may employ junction-based path redirection to execute a malicious wermgr.exe binary located outside of the standard system directory. The rule identifies instances where wermgr.exe is running from non-standard locations, or running at SYSTEM integrity level spawned by standard task-related parent processes, which indicates a potential privilege escalation or persistence attempt (linked to CVE-2026-50656).
Detects potential privilege escalation activity including manual privilege discovery using 'whoami /priv', suspicious elevated processes spawned from non-elevated parents, and specific scheduled task execution patterns associated with Payouts King malware.
Detects suspicious execution patterns originating from or associated with crontab, crond, or anacron processes. The rule identifies potential persistence or malicious task scheduling by monitoring specific command-line indicators such as execution from /tmp or /dev/shm, unusual execution intervals, or specific shell command patterns associated with cron job abuse.
Detects the KuinaExtractor UAC bypass technique, which exploits the auto-elevated 'SilentCleanup' scheduled task. The rule identifies suspicious activity via two patterns: the execution of 'cleanmgr.exe' from an unexpected parent process (bypassing normal task scheduler invocation) or the explicit execution of 'schtasks.exe' to trigger the 'SilentCleanup' task.
This rule detects potentially malicious activity related to the cron utility, including the modification of cron-related configuration files and the execution of specific suspicious payloads (e.g., ssync.sh, blacklist). It monitors for file creation, modification, or renaming events within sensitive directories, as well as the spawning of processes by cron daemons using identified suspicious paths or command names.
Detects the Payouts King malware creating, running, or deleting specific scheduled tasks named \Mozilla\UpdateTask or \Mozilla\ElevateTask, as well as indirect execution of these tasks via cmd.exe redirection.
Detects use of scheduled tasks to break process trees and hide parent relationships
Detects malicious scheduled task activity attributed to the Payouts King threat actor. The rule monitors for the creation, execution, and deletion of tasks using specific naming conventions ('Mozilla\UpdateTask', 'Mozilla\ElevateTask') or patterns (e.g., /ru SYSTEM, /sc ONSTART) executed by non-standard parent processes.
Detects the creation, execution, or deletion of Windows scheduled tasks using 'Mozilla' task names (specifically '\Mozilla\UpdateTask' or '\Mozilla\ElevateTask'). The rule identifies tasks created with SYSTEM privileges and 'ONSTART' triggers via schtasks.exe, as well as associated administrative commands to run or delete these tasks, and correlates these with Security Event ID 4698.
Detects the KuinaExtractor UAC bypass technique, which exploits the auto-elevated 'SilentCleanup' scheduled task. The rule identifies suspicious activity via two patterns: the execution of 'cleanmgr.exe' from an unexpected parent process (bypassing normal task scheduler invocation) or the explicit execution of 'schtasks.exe' to trigger the 'SilentCleanup' task.
Detects specific suspicious behaviors associated with the Payouts King ransomware. It monitors for indirect command execution where cmd.exe is spawned by non-shell processes to programmatically execute schtasks, or the direct invocation of schtasks.exe to execute tasks hidden within paths mimicking Mozilla-related directories for persistence.
This rule detects suspicious activity related to Node.js applications that may indicate malicious manipulation of the environment or persistence mechanisms. It monitors for the loading of a specific hidden library (.libcache.so), usage of the LD_PRELOAD environment variable by node/npm processes, modifications to profile scripts, and irregular crontab entries associated with node execution. This behavior is indicative of dynamic linker hijacking or unauthorized task scheduling for persistence.
This rule detects potentially malicious cron job activity, including modifications to crontab files, execution of cron jobs from world-writable directories (such as /tmp or /dev/shm), and the usage of unusual prime-number timing intervals which are commonly used by attackers to evade standard scheduling patterns.
Identifies the execution of a process with 'VirtualSmokestGuy666' in its command line, which is indicative of CastleRAT Build 666 establishing persistence. This specific string suggests a scheduled task or similar mechanism used by the malware to maintain its presence on the system.
Detects the execution of a scheduled task named OneDriveHealth invoking taskkill on explorer.exe to trigger a hijacked COM object. This rule specifically looks for 'svchost.exe' as the initiating process, executing 'taskkill' with 'explorer.exe' in its command line, which is indicative of a specific attack chain involving scheduled tasks and process termination.
Page 4 of 6