Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
108 detections
Filters
Last updated
All Time
Detection languages
55
20
12
7
5
Contributors
20
19
15
15
11
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
82
23
3
1
1
Products / Services
36
21
19
19
9
MITRE Techniques
97
95
70
68
23
IDS Classtypes
3
IDS Protocols
3
This rule detects the presence of the PowerShell cmdlet 'Enable-ScheduledTask' within the HTTP response body. This could indicate an attacker using a web server to deliver or instruct a client to enable a scheduled task, potentially for persistence or privilege escalation. The detection specifically looks for 'enable-scheduledtask' case-insensitively, optionally preceded by '-taskname' or '-taskpath', within a successful HTTP 200 OK response.
Detects suspicious modification of the crontab file, which can be used by adversaries for persistence, privilege escalation, or execution of malicious code on Unix-like systems. The rule specifically looks for the 'REPLACE' keyword in cron logs, indicating a crontab entry has been changed.
Detects the creation or modification of scheduled tasks via Group Policy Objects (GPO), which can be used by adversaries for persistence, execution, and lateral movement, often seen in ransomware deployment scenarios. The rule specifically looks for Event ID 5136 (Directory Service Changes) indicating modifications to GPO attributes related to machine or user extension names, and Event ID 5145 (Detailed File Share) indicating write access to ScheduledTasks.xml within the SYSVOL share.
Detects when an attacker attempts to modify an existing scheduled task to execute a payload from suspicious locations. This technique allows attackers to bypass detection mechanisms that primarily focus on the creation of new scheduled tasks, by instead altering a legitimate task to include their malicious code.
Detects the deactivation and disabling of the Scheduled defragmentation task using 'schtasks.exe /delete' or 'schtasks.exe /change' commands, specifically targeting the '\Microsoft\Windows\Defrag\ScheduledDefrag' task. This activity has been observed in campaigns by the Slingshot APT group.
Detects the creation or modification of a scheduled task using 'schtasks.exe' that is configured to run with 'NT AUTHORITY\SYSTEM' privileges. This can be an indicator of privilege escalation or persistence.
The following analytic detects the creation or modification of hidden scheduled tasks on Windows systems, which are not visible in the UI. It leverages Windows Security EventCode 4698 to identify tasks where the 'Hidden' setting is enabled. This behavior is significant as it may indicate malware activity, such as Industroyer2, or the use of living-off-the-land binaries (LOLBINs) to download additional payloads. If confirmed malicious, this activity could allow attackers to execute code stealthily, maintain persistence, or further compromise the system by downloading additional malicious payloads.
The analytic detects the creation, modification, or enabling of scheduled tasks that execute commands using native Windows shells (PowerShell, Cmd, Wscript, Cscript) or from public folders (Users, Temp, ProgramData). This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment.
The following analytic detects the creation, modification, or enabling of scheduled tasks with known suspicious or malicious task names. It leverages Windows Security EventCode 4698, 4700, and 4702 to identify when such tasks are registered, modified, or enabled. This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment.
Modifying Crontab
Sigma
Detects suspicious modification of crontab file.
This rule detects activities associated with the SmartLoader malware, including the creation or renaming of specific files (ODE3.exe, Module.class, Lua51.dll) in suspicious user application data directories, the creation or update of scheduled tasks with a specific name ("SecurityHealthService_ODE3"), and the DLL sideloading of "lua51.dll". These activities indicate potential execution, persistence, and defense evasion by the SmartLoader malware.
The following analytic detects potential malicious activities involving PowerShell's task scheduling cmdlets. It leverages PowerShell Script Block Logging (EventCode 4104) to identify unusual or suspicious use of cmdlets like 'New-ScheduledTask' and 'Set-ScheduledTask'. This activity is significant as attackers often use these cmdlets for persistence and remote execution of malicious code. If confirmed malicious, this could allow attackers to maintain access, deliver additional payloads, or execute ransomware, leading to data theft or other severe impacts. Immediate investigation and mitigation are crucial to prevent further compromise.
'The query detects a scheduled task, created/updated remotely, using the Schtasks process.
Threat actors are using scheduled tasks for establishing persistence and moving laterally through the network.
Ref: https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html'
Threat actors are using scheduled tasks for establishing persistence and moving laterally through the network.
Ref: https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html'
'This query detects lateral movement using GPO scheduled task usually used to deploy ransomware at scale.
It monitors whether a scheduled task is modified within the Sysvol folder in GPO.
Ref: https://bogusecurity.com/2019/12/26/persistence-and-execution-at-scale-via-gpo-scheduled-task/'
It monitors whether a scheduled task is modified within the Sysvol folder in GPO.
Ref: https://bogusecurity.com/2019/12/26/persistence-and-execution-at-scale-via-gpo-scheduled-task/'
The following analytic detects potential tampering with cronjob files on a Linux system by identifying 'echo' commands that append code to existing cronjob files. It leverages logs from Linux Auditd, focusing on process names, parent processes, and command-line executions. This activity is significant because adversaries often use it for persistence or privilege escalation. If confirmed malicious, this could allow attackers to execute unauthorized code automatically, leading to system compromises and unauthorized data access, thereby impacting business operations and data integrity.
Detects when a Kubernetes CronJob or Job is created, modified, or deleted. A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule. An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence.
The following analytic detects the suspicious editing of cron jobs in Linux using the crontab command-line parameter (-e). It identifies this activity by monitoring command-line executions involving 'crontab' and the edit parameter. This behavior is significant for a SOC as cron job manipulations can indicate unauthorized persistence attempts or scheduled malicious actions. If confirmed malicious, this activity could lead to system compromise, unauthorized access, or broader network compromise.
The following analytic detects the execution of a command to disable an existing scheduled task using 'schtasks.exe' with the '/change' and '/disable' parameters. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. Disabling scheduled tasks is significant as it is a common tactic used by adversaries, including malware like IcedID, to disable security applications and evade detection. If confirmed malicious, this activity could allow attackers to persist undetected, disable critical security defenses, and further compromise the targeted host.
The analytic detects the suspicious editing of cron jobs in Linux using the `crontab` command-line parameter (`-e`). It identifies this activity by monitoring command-line executions involving 'crontab' and the edit parameter. This behavior is significant for a SOC as cron job manipulations can indicate unauthorized persistence attempts or scheduled malicious actions. If confirmed malicious, this activity could lead to system compromise, unauthorized access, or broader network compromise.
This rule detects the creation, modification, or deletion of scheduled tasks using specific task names known to be associated with the SVR-attributed GraphicalProton backdoor. The task names are designed to mimic legitimate Windows services to evade detection.
This rule detects the creation, modification, or deletion of scheduled tasks with specific names known to be used by the SVR-affiliated GraphicalProton backdoor. The rule monitors Windows Security Event IDs 4698 (A scheduled task was created), 4699 (A scheduled task was deleted), and 4702 (A scheduled task was updated) for a predefined list of suspicious task names.
Page 5 of 6