Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
108 detections
Filters
Last updated
All Time
Detection languages
55
20
12
7
5
Contributors
20
19
15
15
11
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
82
23
3
1
1
Products / Services
36
21
19
19
9
MITRE Techniques
97
95
70
68
23
IDS Classtypes
3
IDS Protocols
3
Detects the creation or modification of Windows Scheduled Tasks involving system-level components. The rule monitors modifications to the TaskCache registry keys specifically containing 'System' or the creation of task files in the System32 directory. It excludes trusted processes like msiexec.exe and trustedinstaller.exe, which are typically responsible for legitimate system updates or installations.
Detects the creation or modification of scheduled tasks using the 'schtasks.exe' utility, specifically looking for indicators associated with persistence mechanisms such as task names or commands like 'StandAloneOneDriveUpdater-2626' and 'Automata-20.exe'.
Detects the creation or modification of crontab files, as well as the execution of crontab commands, that involve suspicious paths (e.g., /tmp, /var/tmp, /dev/shm, hidden files) or command obfuscation techniques such as base64 encoding. This behavior is often associated with the establishment of persistence by adversaries.
Detects the modification or creation of scheduled tasks using OOBETaskScheduler or referencing Windows Servicing paths, combined with network connections to known malicious domains identified in threat intelligence.
Detects the use of 'schtasks.exe' to disable critical Windows Update or ExploitGuard Malware Removal tasks when initiated by 'LockAppHost.exe'. This behavior is highly irregular, as the LockAppHost process is typically associated with the Windows Lock Screen and should not be modifying security-related scheduled tasks.
Detects the creation or modification of crontab files, as well as the execution of crontab commands, that involve suspicious paths (e.g., /tmp, /var/tmp, /dev/shm, hidden files) or command obfuscation techniques such as base64 encoding. This behavior is often associated with the establishment of persistence by adversaries.
Detects the use of 'schtasks.exe' to disable critical Windows Update or ExploitGuard Malware Removal tasks when initiated by 'LockAppHost.exe'. This behavior is highly irregular, as the LockAppHost process is typically associated with the Windows Lock Screen and should not be modifying security-related scheduled tasks.
Detects the creation or modification of crontab files, as well as the execution of crontab commands, that involve suspicious paths (e.g., /tmp, /var/tmp, /dev/shm, hidden files) or command obfuscation techniques such as base64 encoding. This behavior is often associated with the establishment of persistence by adversaries.
Detects the use of 'schtasks.exe' to disable critical Windows Update or ExploitGuard Malware Removal tasks when initiated by 'LockAppHost.exe'. This behavior is highly irregular, as the LockAppHost process is typically associated with the Windows Lock Screen and should not be modifying security-related scheduled tasks.
Detects the use of 'schtasks.exe' to disable critical Windows Update or ExploitGuard Malware Removal tasks when initiated by 'LockAppHost.exe'. This behavior is highly irregular, as the LockAppHost process is typically associated with the Windows Lock Screen and should not be modifying security-related scheduled tasks.
Detects the creation or modification of crontab files, as well as the execution of crontab commands, that involve suspicious paths (e.g., /tmp, /var/tmp, /dev/shm, hidden files) or command obfuscation techniques such as base64 encoding. This behavior is often associated with the establishment of persistence by adversaries.
Detects the creation or modification of crontab files, as well as the execution of crontab commands, that involve suspicious paths (e.g., /tmp, /var/tmp, /dev/shm, hidden files) or command obfuscation techniques such as base64 encoding. This behavior is often associated with the establishment of persistence by adversaries.
Detects the use of 'schtasks.exe' to disable critical Windows Update or ExploitGuard Malware Removal tasks when initiated by 'LockAppHost.exe'. This behavior is highly irregular, as the LockAppHost process is typically associated with the Windows Lock Screen and should not be modifying security-related scheduled tasks.
This rule detects the creation or modification of cron jobs that schedule recurring tasks (every 5 or 10 minutes) designed to download remote scripts using wget or curl and pipe them directly into a shell interpreter (sh or bash) for execution. This behavior is indicative of persistent malware, such as botnets, re-fetching and executing secondary payloads.
Detects crontab modifications referencing hw_probe.pyc, the cron-based persistence mechanism used by the mrmustard stealer.
Detects crontab modifications referencing hw_probe.pyc, the cron-based persistence mechanism used by the mrmustard stealer.
This rule monitors for suspicious activity aimed at disabling or tampering with security software, including antivirus processes and services. It identifies execution of tools named 'AVKiller.exe', the usage of commands like 'taskkill', 'net stop', or 'sc stop' against known security-related processes, and the modification of Windows Defender scheduled tasks to disable security scans.
Detects the use of the schtasks utility to modify and disable scheduled tasks related to Microsoft Windows Defender, specifically the scheduled scan, cache maintenance, and verification tasks. This behavior is indicative of an attempt to impair security defenses on a Windows host.
This rule detects the creation or configuration of a scheduled task named 'GoogleErrorReport' which references 'Fondue.exe' located in the 'C:\Users\Public' directory. This specific pattern is associated with 'Dropping Elephant' malware persistence, where the task ensures the binary executes persistently on the host.
Detects the creation of a scheduled task named 'OneDriveHealth', which is associated with APT28 activity. This task is used for persistence via COM hijacking; it executes 60 seconds after registration, kills and restarts explorer.exe to facilitate the loading of a hijacked COM object, and subsequently removes itself.
This rule detects potentially malicious activity related to cron job scheduling. It monitors for three distinct stages: (1) direct modification of crontab files or directories using common shell utilities, (2) suspicious file write operations to critical cron configuration paths, and (3) execution of shell scripts or binaries from unusual directories (e.g., /tmp, /dev/shm) where the parent process is a cron utility.
Page 2 of 6