Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
159 detections
Filters
Last updated
All Time
Detection languages
60
53
11
9
8
Contributors
33
24
20
17
15
Categories
100
100
95
12
10
Platforms
159
4
1
Products / Services
45
28
27
27
20
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
1
IDS Classtypes
6
IDS Protocols
6
Detects the creation of scheduled tasks with specific names ('SC Scheduled Scan' or 'UpdatMachine') that have been associated with the OilRig APT group for persistence, as reported by Nyotron in March 2018.
This rule detects activity associated with the OilRig APT group, as detailed in Nyotron's March 2018 report. Specifically, it looks for the creation of a scheduled task named 'SC Scheduled Scan' that executes 'autoit3.exe' from a specific path, execution of executables within a '
Windows\Temp\DB\' directory, execution of 'C:\Windows\system32\Service.exe' with specific command-line arguments, and 'autoit3.exe' spawning 'nslookup.exe' with DNS TXT query parameters. These indicators collectively point to persistence mechanisms, execution of malicious payloads, and DNS-based command and control used by OilRig.
Windows\Temp\DB\' directory, execution of 'C:\Windows\system32\Service.exe' with specific command-line arguments, and 'autoit3.exe' spawning 'nslookup.exe' with DNS TXT query parameters. These indicators collectively point to persistence mechanisms, execution of malicious payloads, and DNS-based command and control used by OilRig.
Detects when an attacker attempts to modify an existing scheduled task to execute a payload from suspicious locations. This technique allows attackers to bypass detection mechanisms that primarily focus on the creation of new scheduled tasks, by instead altering a legitimate task to include their malicious code.
Detects potential exploitation of the BearLPE exploit using Task Scheduler ".job" import arbitrary DACL write. This rule specifically looks for the execution of 'schtasks.exe' with command-line arguments indicative of modifying an existing scheduled task's properties, such as changing the user account and password, which could be abused in privilege escalation scenarios.
Detects the creation of a scheduled task using 'schtasks create' in conjunction with 'wscript' and '/e:vbscript', which is a known persistence mechanism used by the ACTINIUM threat group.
Detects scheduled task creation using the 'schtasks' utility that incorporates suspicious or uncommon command-line patterns. This includes tasks scheduled to run frequently (e.g., every minute) or as the 'system' user, combined with common command interpreters ('cmd'), or containing keywords often associated with malicious activity like PowerShell download commands, obfuscation techniques, or execution from temporary/public user directories. It also flags the use of scripting engines (cscript, wscript) or curl within scheduled tasks.
Detects the creation of new scheduled tasks via commandline using `schtasks.exe` that specifically call `OpenSSH` components (`sshd.exe` or `ssh.exe`) with parameters indicative of establishing a reverse SSH tunnel. This activity suggests an adversary is attempting to establish persistence and command-and-control by creating a scheduled task to maintain a connection to their server.
Detects the deactivation and disabling of the Scheduled defragmentation task using 'schtasks.exe /delete' or 'schtasks.exe /change' commands, specifically targeting the '\Microsoft\Windows\Defrag\ScheduledDefrag' task. This activity has been observed in campaigns by the Slingshot APT group.
Detects manual execution of the "Microsoft Compatibility Appraiser" task via schtasks. This activity is often used to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.
Detects the creation or modification of a scheduled task using 'schtasks.exe' that is configured to run with 'NT AUTHORITY\SYSTEM' privileges. This can be an indicator of privilege escalation or persistence.
Detects the creation of a scheduled task using 'schtasks.exe' that is configured to execute a file from the 'C:\Users\<USER>\AppData\Local' directory. This behavior is often indicative of malware establishing persistence or privilege escalation, as the AppData\Local folder is a common location for user-specific application data and can be written to without administrative privileges. The rule specifically looks for tasks created to run under 'NT AUTHORITY\SYSTEM' or 'SYSTEM' accounts, which would grant elevated privileges to the executed payload.
Detects the creation or modification of scheduled tasks using `schtasks.exe` with suspicious schedule types such as 'ONLOGON', 'ONSTART', 'ONCE', or 'ONIDLE'. This rule specifically filters out common legitimate system accounts like 'NT AUTHORITY\SYSTEM' and 'SYSTEM' and the 'HIGHEST' privilege setting to reduce false positives.
Detects the creation or modification of scheduled tasks using 'schtasks.exe' that are configured to run with high privileges (NT AUTHORITY\SYSTEM, SYSTEM, or HIGHEST) and utilize suspicious schedule types such as ONLOGON, ONSTART, ONCE, or ONIDLE. This combination is often indicative of persistence or privilege escalation attempts by adversaries.
Detects the creation of scheduled tasks using 'schtasks.exe' that are configured to run only once and involve a temporary folder in their command line. This behavior can be indicative of an adversary establishing temporary persistence or execution mechanisms, often seen in post-exploitation activities.
Detects the execution of the BitLocker Access Agent Update Utility (baaupdate.exe) spawning suspicious child processes. This activity is uncommon for baaupdate.exe and could indicate an attempt at lateral movement or defense evasion, potentially via BitLocker DCOM & COM Hijacking, by using baaupdate.exe as a proxy for executing other system utilities.
The following analytic identifies the creation or deletion of scheduled tasks using the schtasks.exe utility with the -create or -delete flags. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it can indicate unauthorized system manipulation or malicious intent, often associated with threat actors like Dragonfly and incidents such as the SUNBURST attack. If confirmed malicious, this activity could allow attackers to execute code, escalate privileges, or persist within the environment, posing a significant security risk.
The analytic identifies the creation of scheduled tasks that execute binaries or scripts from public directories, such as Users\Public, ProgramData, or Windows\Temp, using schtasks.exe with the /create command. This activity often indicates an attempt to maintain persistence or execute malicious scripts, which are common tactics in malware deployment. If confirmed as malicious, this could lead to data compromise, unauthorized access, and potential lateral movement within the network.
Detects the creation of a scheduled task named "MicrosoftsUpdate" which is used to execute a malicious batch file as part of the HrServ web shell infection chain.
The analytic detects the use of 'schtasks.exe' to create a scheduled task on a remote system, indicating potential lateral movement or remote code execution. It leverages process data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line arguments and flags. This activity is significant as it may signify an adversary's attempt to persist or execute code remotely. If confirmed malicious, this could allow attackers to maintain access, execute arbitrary commands, or further infiltrate the network, posing a severe security risk.
KQL Query from file: High-Risk assets with command line credentials
Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report
Page 5 of 8